Malware Analysis Report

2024-09-22 12:57

Sample ID 240620-lemxqazepd
Target cleaners.zip
SHA256 4ee85019c1ae4d1abf8ea1908f635339d0a4af88ba185dc30e1104e68c7c902e
Tags
themida cerber evasion execution persistence privilege_escalation ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4ee85019c1ae4d1abf8ea1908f635339d0a4af88ba185dc30e1104e68c7c902e

Threat Level: Known bad

The file cleaners.zip was found to be: Known bad.

Malicious Activity Summary

themida cerber evasion execution persistence privilege_escalation ransomware spyware stealer trojan

Disables service(s)

Cerber

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Server Software Component: Terminal Services DLL

Modifies Windows Firewall

Stops running service(s)

Reads user/profile data of web browsers

Checks BIOS information in registry

Themida packer

Executes dropped EXE

Event Triggered Execution: Component Object Model Hijacking

Checks whether UAC is enabled

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks system information in the registry

Drops file in Windows directory

Launches sc.exe

Unsigned PE

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies registry class

Modifies registry key

Suspicious use of FindShellTrayWindow

Gathers network information

Runs net.exe

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Enumerates system info in registry

Uses Volume Shadow Copy WMI provider

Suspicious use of SendNotifyMessage

Kills process with taskkill

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-20 09:26

Signatures

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-20 09:26

Reported

2024-06-20 09:30

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx32.exe"

Signatures

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx32.exe

"C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx32.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-20 09:26

Reported

2024-06-20 09:30

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx64.exe"

Signatures

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx64.exe

"C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx64.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 106.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 90.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 09:26

Reported

2024-06-20 09:39

Platform

win10v2004-20240508-en

Max time kernel

736s

Max time network

719s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\cleaners.zip

Signatures

Cerber

ransomware cerber

Disables service(s)

evasion execution

Server Software Component: Terminal Services DLL

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Winmgmt\Parameters\ServiceDll = "%SystemRoot%\\system32\\wbem\\WMIsvc.dll" C:\Windows\system32\regsvr32.exe N/A

Stops running service(s)

evasion execution

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Reads user/profile data of web browsers

spyware stealer

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\wbem\AutoRecover\0720D9FC0F3CE94CCD335F8433026C89.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\1DC2C95229D95D90A3805FA9F06B41C2.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\2C9C1984F2B70D09B7AB9DBCD2C5DFA3.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\85374C59A58BC4DD6EE11E38AF4AC4EC.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\5C7610DB4A9C098F3962CAAD6BA8E4D8.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\AFD8B7D322EE2A1CB2BAF41EC0ADF626.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\568257F0F7CB54EB479EA5E39A4ACD57.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\6CC07C0289722A5549B9C30F76C249FF.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\67370BADC943F6B7B1B4F439836513A4.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\AA69B9C8BBEB509BBB296FEDD7B5ED23.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\C9824ADC136E4798F4F76A6D48117DA8.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\5EC0A7251343D4B7BEC3433678C05FBD.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\DB3146B20DA7C2E4A0823DDFDC608499.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\DB54C5562A50379EFADA86F9B3861ABC.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\15CB6E2BC4C7288B6A26F06F2EA3EBAA.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\1348239330EA577EA6772675FA01A277.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\73A48AD552FEB3426659A2CA5F04DD56.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\EAE731B1CFFF749C3A1B72EF0CEC7C59.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\B4D19FC244B76FAB409A3E64E4631B5A.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\2917088B74A4F3A42391D9615CE677B6.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\35BB8CAA7877397A4B61EC9571EB8D58.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\D0970F055BBA0661C7AC91B7E8C24CA3.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\4BAA6C97BAFFF89E4766A6C005936213.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\3B72DD6E3EC71817FF6A001F937A7FBD.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\C3CA0FC7DA1F7810A080F401E0C9D111.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\5662B680A2DE579FC7CEAEE7AFF02255.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\49570CF88DED3D22D2855A44F0FD36EC.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\BD557D61619F268BDCEA21C2BDB91514.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\25CE4D0A477A7A536B1F5C9965A6C9E4.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\9476FC534A628F39C9E25CA2F2B7B45E.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\335BFF0143AA9C8773F43BCD8341BC65.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\1641F982282E8CA70B0D93F1F2BB145B.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\60B27498E9CF2F77D7B3B07ECEAC41BA.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\03DE10D374EFFB94AB99BF6CE6A8238D.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\12233E25C50AF3A2E910EC7C056C6EDB.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\1099FEEE138E2E31F814A055BBBFE886.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\F57B1568690BC96B837BB77BDC299C92.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\2481BD368BB01085863E70D5441806EB.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\0A7CF62821E141ADACC0C287DDD01839.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\3D93BA5591BD981C5D5D6E2BEFACAA50.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\06DEE93B2013BBE13958B3FA0D45AEB5.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\F8E338E33AC9A128161D8776F540DE3F.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\186BE2C4D6E28AC17ACEC4D7E0AE954A.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\7A4CB0AABC494B5EF617433CD14FFE40.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\A0DE0DD786E0E9020C3DFD7004E42694.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\9609E7F8420C3D72112ABDD53C1C4F6A.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\86AD2F7FA2D484F977B368469AD09098.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\8C718B5AFD373885B68D2836088CAF9A.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\05C3A1B4103106E2A6595CB64A18450B.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\5D30F5D5A8D8609DF304FE058934E6DD.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\61EE6F125EE84F973323047E63234C4B.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\A0925B7CAE67304DB8A7D8B009B810D1.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\39C2F82384C755EF218F0F19FE619F80.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\678BF84C9AFA9DDD4DD5C98EE9AA5AB0.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\8BF0E140F8F40D230143B569A1BAE507.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\3F78FC5E2CC6CFD8720C796D34A544F7.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\7291B3778FC5B202D807DDCFC6FF3AD5.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\6032686C573E67C19FEC6BD39BFF4F49.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\D7B94FF620323D536A3B99CCAA6B78DA.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\F5CDD48A01B87D4CA42A123F9669B689.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\18BDF5545DA4DA075E608B608094BD1E.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\0471EE6D56711CCAFEBCF01C57F9159A.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\37846654B2AF369ED3D0A3637E941D9B.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\37E6D5BCA82C4A6E42A5411612538CD4.mof C:\Windows\System32\wbem\mofcomp.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\inf\WmiApRpl\WmiApRpl.h C:\Windows\system32\regsvr32.exe N/A
File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h C:\Windows\system32\regsvr32.exe N/A
File created C:\Windows\inf\WmiApRpl\WmiApRpl.ini C:\Windows\system32\regsvr32.exe N/A
File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.ini C:\Windows\system32\regsvr32.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Checks processor information in registry

Description Indicator Process Target
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString N/A N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 N/A N/A

Enumerates system info in registry

Description Indicator Process Target
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor N/A N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS N/A N/A
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate N/A N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS N/A N/A
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName N/A N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS N/A N/A
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer N/A N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS N/A N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1EF94880-01A8-11D2-A90B-00AA00BF3363} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7E9D3B9-E62B-4A90-8CC5-A3C5F662DA7B}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{D215781D-019E-4FA0-903D-0CDCDE13A4F5}\AccessPermission = 010004804800000054000000000000001400000002003400020000000100180001000000010200000000000520000000210200000000140001000000010100000000000512000000010100000000000512000000010100000000000512000000 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED999FF5-223A-4052-8ECE-0B10C8DBAA39}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\ProgID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WbemScripting.SWbemNamedValueSet.1\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0E4EDDE-475A-498A-93D7-D4347F68A8F3}\ProxyStubClsid32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JobObjSecLimitInfoProv.JobObjSecLimitInfoProv\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2D588B5-D081-11D0-99E0-00C04FC2F8EC}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{04788120-12C2-498D-83C1-A7D92E677AC6}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9AED384E-CE8B-11D1-8B05-00600806D9B6}\ProgID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1B55910-8BA0-47A5-A16E-2B733B1D987C}\ProxyStubClsid32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\NumMethods C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv\CurVer\ = "JobObjLimitInfoProv.JobObjLimitInfoProv.1" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F55C5B4C-517D-11D1-AB57-00C04FD9159E} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F55C5B4C-517D-11D1-AB57-00C04FD9159E}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5791BC26-CE9C-11D1-97BF-0000F81E849C}\ProgID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{AA527A40-4D9A-11D2-93AD-00805F853771} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\Programmable C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31739D04-3471-4CF4-9A7C-57A44AE71956}\NumMethods C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{7F72CC7A-74A0-45B4-909C-14FB8186DD7E} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\Software\classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{F00B4404-F8F1-11CE-A5B6-00AA00680C3F} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D269BF5C-D9C1-11D3-B38F-00105A1F473A}\Version C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\winmgmt C:\Windows\system32\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7E9D3B9-E62B-4A90-8CC5-A3C5F662DA7B}\Version C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75718C9A-F029-11D1-A1AC-00C04FB6C223}\TypeLib C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A0DC377-A9D3-41CB-BD69-AE1FDAF2DC68}\NumMethods C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB40A5C1-804B-40BD-9DFE-A640691C6956}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WbemScripting.SWbemLocator\CurVer C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WbemScripting.SWbemObjectPath.1\ = "WBEM Scripting Object Path 1.0" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Interface C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}\NumMethods C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{755F9DA6-7508-11D1-AD94-00C04FD8FDFF} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\WbemScripting.SWbemObjectPath.1 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\WbemScripting.SWbemDateTime.1 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6515834D-6125-4878-A3A3-6B0A73B809A2} C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Krnlprov.KernelTraceProvider\CurVer\ = "Krnlprov.KernelTraceProvider.1" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55F7B88D-A254-4B22-B7BB-FCDBBA1AFA32}\ = "UserConfigurationProvider Class" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}\ProxyStubClsid32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{6D7A4B0E-66D5-4AC3-A7ED-0189E8CF5E77} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B100E1A-1385-4D1F-A02E-6E705A76BB6C} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266C72E5-62E8-11D1-AD89-00C04FD8FDFF}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{631F7D96-D993-11D2-B339-00105A1F4AAF}\NumMethods C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35B78F79-B973-48C8-A045-CAEC732A35D5} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0C0B0642-1DEB-43DF-8032-7A9BF5811A74}\Version C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1B9E04A-3226-11D2-883E-00104B2AFB46}\VersionIndependentProgID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2FEEEAC-CFCD-11D1-8B05-00600806D9B6}\TypeLib C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WbemScripting.SWbemRefresher\CurVer\ = "WbemScripting.SWbemRefresher.1" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{88F3781C-6902-4647-9A6B-A74F450AF861}\NumMethods C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FCF7A6F2-3300-4386-9A4F-0DD4E3226507}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\CLSID C:\Windows\system32\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC231970-6AFD-4215-A72E-97242BB08680}\InProcServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A359DEC5-E813-4834-8A2A-BA7F1D777D76} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60E512D4-C47B-11D2-B338-00105A1F4AAF}\ProxyStubClsid32 C:\Windows\system32\regsvr32.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Runs net.exe

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\mofcomp.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zG.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4444 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\Spoofer.exe C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx64.exe
PID 4444 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\Spoofer.exe C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx64.exe
PID 4444 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\Spoofer.exe C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx32.EXE
PID 4444 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\Spoofer.exe C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx32.EXE
PID 4444 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\Spoofer.exe C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx64.exe
PID 4444 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\Spoofer.exe C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx64.exe
PID 4444 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\Spoofer.exe C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx32.EXE
PID 4444 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\Spoofer.exe C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx32.EXE
PID 4444 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\Spoofer.exe C:\Windows\system32\cmd.exe
PID 4444 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\Spoofer.exe C:\Windows\system32\cmd.exe
PID 4444 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\Spoofer.exe C:\Windows\system32\cmd.exe
PID 4444 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\Spoofer.exe C:\Windows\system32\cmd.exe
PID 4032 wrote to memory of 2200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cacls.exe
PID 4032 wrote to memory of 2200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cacls.exe
PID 4032 wrote to memory of 3476 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 3476 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 396 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 396 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 2380 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 2380 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 2280 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 2280 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 1972 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 1972 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 4264 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 4264 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 404 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 404 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 3040 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 3040 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 528 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 528 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 2680 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 2680 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 4432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 4432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 4648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 4648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 1332 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 1332 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4032 wrote to memory of 3012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 4032 wrote to memory of 3012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 4032 wrote to memory of 1112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 4032 wrote to memory of 1112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 4032 wrote to memory of 3272 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 4032 wrote to memory of 3272 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 4032 wrote to memory of 1244 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 4032 wrote to memory of 1244 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 4032 wrote to memory of 2020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 4032 wrote to memory of 2020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 4032 wrote to memory of 2012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 4032 wrote to memory of 2012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 2012 wrote to memory of 4584 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 2012 wrote to memory of 4584 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 4032 wrote to memory of 1184 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4032 wrote to memory of 1184 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4032 wrote to memory of 2516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\regsvr32.exe
PID 4032 wrote to memory of 2516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\regsvr32.exe
PID 4032 wrote to memory of 2800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\regsvr32.exe
PID 4032 wrote to memory of 2800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\regsvr32.exe
PID 4032 wrote to memory of 4932 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\regsvr32.exe
PID 4032 wrote to memory of 4932 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\regsvr32.exe
PID 4032 wrote to memory of 2204 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\regsvr32.exe
PID 4032 wrote to memory of 2204 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\regsvr32.exe

Uses Volume Shadow Copy WMI provider

ransomware

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\cleaners.zip

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\cleaners\" -spe -an -ai#7zMap3581:96:7zEvent25019

C:\Users\Admin\AppData\Local\Temp\cleaners\Spoofer.exe

"C:\Users\Admin\AppData\Local\Temp\cleaners\Spoofer.exe"

C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx64.exe

C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx64.exe C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx64.sys

C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx32.EXE

C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx32.EXE C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx64.sys

C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx64.exe

C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx64.exe C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\gsoftgmx64.sys

C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx32.EXE

C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx32.EXE C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\gsoftgmx64.sys

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\cleaners\cleaners\cleaner.bat

C:\Windows\system32\cacls.exe

"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"

C:\Windows\system32\taskkill.exe

taskkill /f /im epicgameslauncher.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im FortniteClient-Win64-Shipping_BE.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im FortniteLauncher.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im OneDrive.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im FortniteClient-Win64-Shipping.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im EpicGamesLauncher.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im UnrealCEFSubProcess.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im CEFProcess.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im EasyAntiCheat.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im BEService.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im BEServices.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im BattleEye.exe

C:\Windows\system32\sc.exe

Sc stop EasyAntiCheat

C:\Windows\system32\sc.exe

Sc stop FortniteClient-Win64-Shipping_EAC

C:\Windows\system32\sc.exe

Sc stop BattleEye

C:\Windows\system32\sc.exe

Sc stop FortniteClient-Win64-Shipping_BE

C:\Windows\system32\sc.exe

sc config winmgmt start= disabled

C:\Windows\system32\net.exe

net stop winmgmt /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop winmgmt /y

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c dir /b *.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s appbackgroundtask.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s cimwin32.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s DMWmiBridgeProv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s DMWmiBridgeProv1.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s dnsclientcim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s dnsclientpsprovider.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s Dscpspluginwkr.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s dsprov.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s EmbeddedLockdownWmi.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s esscli.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s EventTracingManagement.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s fastprox.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s ipmiprr.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s ipmiprv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s KrnlProv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s MDMAppProv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s MDMSettingsProv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s Microsoft.AppV.AppVClientWmi.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s Microsoft.Uev.AgentWmi.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s MMFUtil.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s mofd.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s mofinstall.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s msdtcwmi.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s msiprov.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s NCProv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s ndisimplatcim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s NetAdapterCim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s netdacim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s NetEventPacketCapture.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s netnccim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s NetPeerDistCim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s netswitchteamcim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s NetTCPIP.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s netttcim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s nlmcim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s ntevt.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s PolicMan.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s PrintManagementProvider.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s qoswmi.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s RacWmiProv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s repdrvfs.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s schedprov.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s ServDeps.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s SMTPCons.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s stdprov.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s vdswmi.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s viewprov.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s vpnclientpsprovider.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s vsswmi.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wbemcntl.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wbemcons.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wbemcore.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wbemdisp.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wbemess.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wbemprox.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wbemsvc.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WdacWmiProv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wfascim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s Win32_EncryptableVolume.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s Win32_Tpm.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WinMgmtR.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WmiApRes.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WmiApRpl.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WMICOOKR.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WmiDcPrv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wmipcima.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wmipdfs.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wmipdskq.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WmiPerfClass.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WmiPerfInst.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WMIPICMP.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WMIPIPRT.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WMIPJOBJ.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wmiprov.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WmiPrvSD.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WMIPSESS.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WMIsvc.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wmitimep.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wmiutils.dll

C:\Windows\System32\wbem\WmiPrvSE.exe

wmiprvse /regserver

C:\Windows\System32\wbem\WinMgmt.exe

winmgmt /regserver

C:\Windows\system32\sc.exe

sc config winmgmt start= auto

C:\Windows\system32\net.exe

net start winmgmt

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 start winmgmt

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c dir /s /b *.mof *.mfl

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\aeinv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AgentWmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AgentWmiUninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\appbackgroundtask.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\appbackgroundtask_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AuditRsop.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\authfwcfg.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\bcd.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\BthMtpEnum.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\cimdmtf.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\cimwin32.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\CIWmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\classlog.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\cli.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\cliegaliases.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ddp.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\dimsjob.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\dimsroam.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\DMWmiBridgeProv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\DMWmiBridgeProv1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\DMWmiBridgeProv1_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\DMWmiBridgeProv_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\dnsclientcim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\dnsclientpsprovider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\dnsclientpsprovider_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\drvinst.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\DscCore.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\DscCoreConfProv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\dscproxy.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\DscTimer.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\dsprov.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\eaimeapi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\embeddedlockdownwmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\embeddedlockdownwmi_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\EventTracingManagement.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\fdPHost.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\fdrespub.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\fdSSDP.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\fdWNet.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\fdWSD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\filetrace.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\firewallapi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\FolderRedirectionWMIProvider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\FunDisc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\fwcfg.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\hbaapi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\hnetcfg.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\IMAPIv2-Base.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\IMAPIv2-FileSystemSupport.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\IMAPIv2-LegacyShim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\interop.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\IpmiDTrc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ipmiprv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\IpmiPTrc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ipsecsvc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\iscsidsc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\iscsihba.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\iscsiprf.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\iscsirem.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\iscsiwmiv2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\iscsiwmiv2_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\kerberos.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\krnlprov.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\L2SecHC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\lltdio.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\lltdsvc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\lsasrv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mblctr.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\MDMAppProv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\MDMAppProv_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\MDMSettingsProv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\MDMSettingsProv_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Microsoft-Windows-OfflineFiles.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Microsoft-Windows-Remote-FileSystem.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Microsoft.AppV.AppVClientWmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Microsoft.Uev.ManagedAgentWmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Microsoft.Uev.ManagedAgentWmiUninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mispace.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mispace_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mmc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mountmgr.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mpeval.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mpsdrv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mpssvc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\MsDtcWmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\msfeeds.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\msfeedsbs.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\msi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\msiscsi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\MsNetImPlatform.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mstsc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mstscax.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\msv1_0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mswmdm.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ncprov.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ncsi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ndistrace.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetAdapterCim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetAdapterCimTrace.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetAdapterCimTraceUninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetAdapterCim_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\netdacim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\netdacim_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetEventPacketCapture.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetEventPacketCapture_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\netnccim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\netnccim_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetPeerDistCim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetPeerDistCim_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\netprofm.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetSwitchTeam.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetTCPIP.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetTCPIP_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\netttcim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\netttcim_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\networkitemfactory.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\newdev.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\nlasvc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\nlmcim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\nlmcim_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\nlsvc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\npivwmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\nshipsec.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ntevt.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ntfs.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\OfflineFilesConfigurationWmiProvider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\OfflineFilesConfigurationWmiProvider_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\OfflineFilesWmiProvider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\OfflineFilesWmiProvider_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\p2p-mesh.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\p2p-pnrp.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\pcsvDevice.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\pcsvDevice_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\PNPXAssoc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\PolicMan.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\polproc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\polprocl.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\polprou.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\polstore.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\portabledeviceapi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\portabledeviceclassextension.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\portabledeviceconnectapi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\portabledevicetypes.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\portabledevicewiacompat.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\powermeterprovider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\PowerPolicyProvider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ppcRsopCompSchema.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ppcRsopUserSchema.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\PrintFilterPipelineSvc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\PrintManagementProvider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\profileassociationprovider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\PS_MMAgent.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\qmgr.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\qoswmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\qoswmitrc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\qoswmitrc_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\qoswmi_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\RacWmiProv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\rdpendp.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\rdpinit.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\rdpshell.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\refs.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\refsv1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\regevent.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Remove.Microsoft.AppV.AppvClientWmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\rsop.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\rspndr.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\samsrv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\scersop.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\schannel.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\SchedProv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\scm.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\scrcons.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\sdbus.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\secrcw32.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\SensorsClassExtension.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ServiceModel.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ServiceModel35.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\services.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\setupapi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\SmbWitnessWmiv2Provider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\smbwmiv2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\smtpcons.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\sppwmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\sr.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\sstpsvc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\storagewmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\storagewmi_passthru.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\storagewmi_passthru_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\storagewmi_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\stortrace.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\subscrpt.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\system.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\tcpip.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\tsallow.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\tscfgwmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\tsmf.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\tspkg.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\umb.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\umbus.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\umpass.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\umpnpmgr.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\UserProfileConfigurationWmiProvider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\UserProfileWmiProvider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\UserStateWMIProvider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\vds.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\vpnclientpsprovider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\vpnclientpsprovider_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\vss.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WBEMCons.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wcncsvc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WdacEtwProv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WdacWmiProv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WdacWmiProv_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Wdf01000.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Wdf01000Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wdigest.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WFAPIGP.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wfascim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wfascim_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WFP.MOF

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wfs.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\whqlprov.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Win32_DeviceGuard.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\win32_encryptablevolume.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Win32_EncryptableVolumeUninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\win32_printer.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Win32_Tpm.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wininit.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\winipsec.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\winlogon.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Winsat.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WinsatUninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wlan.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WLanHC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmipcima.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmipdfs.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmipdskq.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WmiPerfClass.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WmiPerfInst.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmipicmp.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmipiprt.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmipjobj.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmipsess.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmitimep.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WMI_Tracing.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmp.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmpnetwk.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wpdbusenum.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wpdcomp.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wpdfs.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wpdmtp.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wpdshext.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WPDShServiceObj.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wpdsp.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wpd_ci.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wscenter.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WsmAgent.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WsmAgentUninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WsmAuto.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wsp_fs.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wsp_fs_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wsp_health.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wsp_health_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wsp_sr.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wsp_sr_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WUDFx.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Wudfx02000.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Wudfx02000Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WUDFxUninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\xwizards.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\000CA9FCCEA7C766DFE3B6493B9A908F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\016A4FDC29C2CD1C06090D04CC752B4D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\01B65BA66800FEA5CE7F4892966D7559.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\01D083B8F092E9FEF6D9C55A64A75334.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\01EA423F27498C64D3F6C297AE2BD8F2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\020FD1D34279A20EBB3742D63B9E359A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0232BC928C9666E5DB91EC0848F13E18.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0309255AB46E3D6CAE2056340225DDA9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0357610A8F431F78C35A3F00FF8E7E13.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\038145628EF306DCD8FD7686C52BD131.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\03E20F6C54427A7C0DDEE97EC0898FAB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\042E30CED0EE9B02641D0960BD5D6854.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0471EE6D56711CCAFEBCF01C57F9159A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\04920A1D7F20A747256FB48CA8A0147B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\04B1FC5EA475F43F0CF8815E33B5913C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\04D5961EC17DF68D8407B772F9C7DF98.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\050F60C5DEC201482BC14E317519A6F6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\057069C8BCE64220B28DD683690F6879.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0583E7E08D1877A324A2553D19A795EA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\069B498336DCA76D929AAAF5631ED0A5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\06A22D2701E90D7DDCF8AAC0522F2449.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\06DAE99BF3D429EE4946D4BF8BFF8C96.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\06DEE93B2013BBE13958B3FA0D45AEB5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0736061F644ECE849A494F2EDE2008CE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\086D10A6F37ED2F988C9A8EDEF53B707.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\08BF1AF6E61B8456B1D5B42769C3412C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\08D51E934D3BA7EB8F60B6E90B6F1511.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\08F894CB142235B53617974B1893CC74.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\09329A919E0B1FEB9E13BE1D4E8C71B0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0955A3255BE8F939592AA33CBFED6637.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\095DDA6145E278EC67897251831FDD47.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\097C63F5D2B8C4182BEB625A8287192D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\09A251213F70FF824ABB31AACEEAC17F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0A2DA7EA3492D7ECD2C313A8B7490FC1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0A49A422B8A92BD87756E892C1BAEC38.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0A76D835FEE42A0F9B07455539850A30.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0A7CF62821E141ADACC0C287DDD01839.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0B21EB6E1A9BA82714E2C9FCB1DD6E8A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0B7747DAC81B5CDD2893AAE2E4BBE034.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0BE369FFE21F5817AE0847874550D36B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0C0B602529B4AB335EE2B6BDD125ADB2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0C840E79E220554456F582031714D456.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0CB6D8EA6179D949B588A4D328F2A1D5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0CBD6BDA858114EC196F6B41C2CFD3BF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0CCAA8293392639FBA830DD578DB2C02.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0D169F54EB7176F6BF264A5F8562C98B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0DA95863FE4B25CC2D43F0020902CB31.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0DAE6401EA75135DC71C2BF2727AE47F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0DC0A697FFCC592B72AABF89E4FD9156.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0E68BDAB79C00E0C496F8772703BB3AB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0EA772F1A1EDFC2AEE10CC4E22899FA7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0EACEE5F78D8DC364E3C886DBB50601B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0EB7B5521B8E9A713CA5D4DE1135B365.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0EBA1F7B891BD5FE808E91F1D5467AFE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0EBDDF573C99959D239BF0ADB48A18B5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0F6999175ECAE7FD86A81D5F3AC1FA46.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\100C683F4F92BE5F31DCF9E5E8F8A127.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\105E698CE1AE9FA053B763F2C80120D6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\10D697E74C7A4CC694967A7BA1861EE7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\10EDE1FE24EBC1EBE598FDE3A051CB83.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\11992DCCFDD62BD40E85DA67BD91FF88.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1228A6BDE4139369DF7DB4975C62A50A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\128E25AF26A5FD60EC8421A35FE38114.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1364A1ACC2D182FC0E95C7573ADD0308.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\13BC960D220197BCBCC7F1658C34102D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\153FCFE945068754B72A6FC011B37613.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\160386BCC54C67562570A808003698B2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1641F982282E8CA70B0D93F1F2BB145B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1671EBB4B246E464FCB7369EAB2831EF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\16C850723D6D606824E3600992F717AC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\16E269CB069C7242FB610AB48045318B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\170119984F3AA426567DD71E8458DCA1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\172412DF1F8338E4AD006E9F9788ED2A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\173F0B14BCB5F1B2B2258AFA66FA1F6A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\17BCA321685944580A77D03BECECF588.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\17CF414FA1DE5CE02A5C9AC66A2D8F5E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\180E25D92AFCF71A996BC7AC24F27DD5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\18194DF78686FCBACD0E6868ED0E0919.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1898EDEA64C511B1CB8EF5483101FB35.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\18B9AA34B315DE18655875C087F7E147.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\18F122357839ADA1419DDE2C541904BE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\192325CD712AED7BF56940AD3BB9A176.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\195AE1B89E0FF6CD40670E98BAB3A608.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\198029E6BF51E6E158ECF68FF0B36E3A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\19B9819A1C5AE6BC556E1A65834AEC13.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1A62F8CF28E9ED8FBDCEA3D28AC6D3EF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1AA085F45F04FFF42F8B23EE4B1DD6D5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1AEA6E68EBB34016ED94F24ABB9308E5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1B15F9EA2C8E8A55CC1CBE63FB6B4840.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1B1859A081E5E0E923DE7CA17A3AD0E6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1B243182F610F39F48F63ED2AAF2E4C6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1BF02F5F261B4F6E08912C82760B1564.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1C57A0A063E5D1FAE814B23DFF99DA42.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1C6A987B4B0CF81C64F418964D02E590.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1D17F2812D61D6A27510A5356CBCB2C6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1D2F2472E8915C165DD3667793DD6216.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1D39564B78F00E3F6ED4B4A5662781B2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1D3D7B63AE783F3DBBD4FD9F43301BD1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1D770486C382CDC6F1CD832E1D040FEF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1D8E83D3077F05426D7F5E7C92A52BC2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1DD21D310EE87FB8B3301E43E53F9548.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1E3959634C12CA1C92AEBB0AB0A0CD47.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1E50D6323FD92D3DDCD8B52937074C9C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1ED415C5FAB66F75A8BD9D906ED1FD79.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1F539B7D89D5675D5FBC71A5A1E7C62D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1F5D7EA255DEC718E6C93AFC61039C12.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1FD16EA55AB471DAD65A8AE31A92BFE1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\20916DA71EC75FCC409872C3207D9C60.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\20EF0B41F86B67FBB71739AA19D6F941.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\210892B3C5033337B5C4FCD68AA35128.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2131A60D40501A974386B9E42E4FC201.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2174D8A485DAE80D1D90B7E5430F164F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2215A345459824E0504DB85AEBB502CE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\22C5E271CACABCBB6D1BF416CB483DB1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\232692AF542DAC9C19624048D7BCE0F9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\23FFA2BEE2CFCB552EEC22762785E6B4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\25CCB9BAD9B50F42124D935083535916.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\25CE4D0A477A7A536B1F5C9965A6C9E4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\25E9A5A2000F7483536AEC7F5BBAD557.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2794DD6CC13BD11ED558AA64C449E6D7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\28DFEEAE5E755E081510079AEA4BA2DB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\29B55D1D5A0BB6BBFD2F6F1D35B3A1BB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2A2AB14E79261C4C2272F4B50901244C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2A8F8C0C68BF867A9E2A7AB38260A4F9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2B416E2919A9D497584044544D3C8433.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2BF259128A811B9C7417AEAD9F596A8E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2C688638F731D0D535DBB9DA2F979753.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2C6A80FDED75E46CA733976E382559CC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2C7CF4E1EA79BFA00DDAAADCB67FCA96.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2D1A849208186237BBED16B3B5D7238E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2DB099F474FFAB578AD726E4F2905FED.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2DFDBD25A9B159E6B632A69ADD81F446.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2E4D19AFECF3B4188F10CD16C8BB92E1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2E60A4684212330C61E1E8704A619754.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2EC8433E19B30A13955120CB32A18CFC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2F0CC20947142CB05C49044919898802.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2F58A8772B1579A81054587DFC0A68CE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2FA567F6FE2F89694B594B3FAC75D6DF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\30711D4696101AA94690C8C51432F5E2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\30A5229E4F736548D2D9FA13F92C9A82.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\30C22E5728F64CE0E1605A4A77934948.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\30C3808B55CD6C563447B44FC4E9BAD8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\30DFAF0BD5AD387D985719F41E186AD5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\31998CC82EC1ED985097054B275161ED.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\32057A09A1167F6F66F16DA67DF1C918.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3209C3555EE020AE8FA1C869C6A591D9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\320EDC28FFEC3C708AB2DDE6C70FD624.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3281CFB9A42D9486C40C0A4D010D65E6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\329A6D1E4413466F2111A8B0F5C0A51B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\33295A3A1D28CAE3DFB6C5167CCAAE6F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\33A13765948753719F44CA6F7E586909.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\33B9B81C996ACC2B2000070519028F72.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\344FC63DB23C44805CA5C08EAC26522F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\347C4407B808EB65CAFD16126D73D922.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\348C74BBB0C8791244D9BA708604211E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\361C55667115751869AC74207D28DCE7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\36A47C4202A2694FFD79C2BABBD02788.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\36AC724DE559C5D39EB46462A440D4E5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3704297DA195A3B2DADC6D89B6226662.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\371088BC97F0585065A1A08ED83172D6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3778D40681E80056E0C63E6CB18E9E37.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\37846654B2AF369ED3D0A3637E941D9B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\379E5EC415D0E0A49EFDD4B3564BE048.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\37D4F7E4435BDF811F1EC2CBA1EF4A10.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3855849167EAA03A99F4C8450E15A6ED.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\38841DF145EDAB1901F40F6B9A6AF4AA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\38F922911FA0CAE637E5D1EB1013D0F1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\395955902B64122A6EF58A130F284979.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\39C2F82384C755EF218F0F19FE619F80.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3A2F8881A3B96DF2374FCEFB35545D6B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3A65AC537877D583303AEEF0342B5D51.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3A75BC18F00746E3EB756A5A8AB71D56.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3AF58951EB00AD264E4FCF4BA804D893.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3B443485D5F96CA9554D404AA52A1633.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3B60B0417CAF81D69389063C334577F1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3BB167BC6A619E5D11B40C8B9F699327.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3BBB431B659936EB58D4574BC05768CD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3C03DD39D967893238742C503189BA92.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3C11F3A2BFB9588C467B72E02345362F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3C90AAC6E581F57E99B164C33906BD30.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3CA3E3E8C27409E2288B236F5F414F56.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3D486D2EBFD5C380959985A548DC1308.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3D7D7734943CA5F273BDA05F3E1FA20C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3D93BA5591BD981C5D5D6E2BEFACAA50.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3DA405CE6ACE7B7A8320D68D317B9729.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3EB36FAFDAE870DF05542C0B4AAAD7EF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3EE2F37B4639F4307BAF0C707B092F7C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3F78FC5E2CC6CFD8720C796D34A544F7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3FFDD473F026FB198DA9FA65EE71383C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4001CC0C4B56CFDE0493013FC1D9DD0F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\407E61D88570FDFD5EC8891DBF9A3EBC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\40E224B18F4493C1B8E43DBC496D8E68.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4136DDD03841D93F3D820441F60BE055.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\413CED83449192A10E66EAD24743140E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\42CB2CBBDCBB0DB751E51FF6B279C524.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\430091E25BA6C7FE2FE5DC31776BEACC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\434B7316BB2FAD82DC3E5784AC46B4A0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\43535D7A73D735DEFF9DB83057553D39.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\435A088CDF6FE7426084E4B35C1E81C7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\435FA4D2CAB38A1853F91A3BE8F89D4E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4371EC94BF996AF79B062599D10C927E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\43AC153E4DED1737C66AEC0C7EAD9430.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\43EDE2715871F08D0BEFB4C9DE69E247.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\441A12A68AB1A20902A131356BA4CF30.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\44B487D5879BCD6C593C9066936D12AD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\44C46B87678291B7CFBF7D8A6452D98D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\45277ADB2DA919AFFF18833506353174.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4552656C2901FB1533D6679D49B69929.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4561B54041D5F414CB02373F78461708.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\46F812454290EE1E870544BFEAC8C7EF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4795058F848A6BA6FE24E0530CE2E2DF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\47C87AFF6DBF51980E7CA3E36C38B86B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4846320185EA62FBD8507FD7A9D87E61.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\48959878DDCA03B0FA77D806C7C5D743.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\49C04C47AB946E0864486F81F6E251BC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4B69CC652B5189D5B2136DFDC5369593.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4B95063FF713676A54E7221DF8245C78.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4BD7268ABFF9CFF22DA57949025E2667.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4BE30AA8CC2C4C06B41336B9B3878B1E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4BE9D6CB921FE137B78AE9960CDD98B0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4C3FFB127B4E9B67BFACD89178DE3DA3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4CCFEF2D31696D11C8735BD7C8BE14B9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4D9BCF0F509C90FA86E1ED3A34E158A0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4DAE009EE0BC4B9ECA96E59E303AE1E5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4E20565265CAAFBDB6BA1B1C1ADA9D96.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4E34C76D83E2430D779FE9AA17E87200.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4E8CF66DA5DBCEE8F47DFDDF0B14DEC0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4E941341E008BE47EC9639A14271EBF0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4EA32ABEBFE9B0697C450693940F1673.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4EB0E9424AFEF8E5D68D78C36620E253.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4EF05404F86FAFD7EDAB80262970585E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4F4AD4093274B7A7FF28CDBD5AB3032C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4F7C501B863AFCFCE3AE018AC07191F9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\50B277BD2B3C116DBC38CC2D1EB7D427.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\50B5B38557DC642A4BC7282A0C8C4AA2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\50E7AE0A90085737B8F04CDF9460DBEA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\50FC9EDA1918FBC981D89D0390125308.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\51588E4AC5E59453F329EBF5A215ACEC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\517ED769F6478117021531216F609C27.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\51B9369C31C913E211D29AA4D91D4747.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5232DBC5D3EE8EBCEF6CCB4213399B9A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5241D310A7F9B793E5E9EC39E65B7B44.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\52DF56A47A08AD380228C64827D24548.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\531218B396F02B35771F8AD1965A574A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5312CF8C0E1EE738404F2A6E526EB4D0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\536E5C7121076D413E48A32D54E26EA3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\53C2FC20B111DA763C20CFDAF7624A26.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\53C824D10974E3D64CB1537B2770F4AD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\553C27B9785BAD9A0C6E81613DD3FCB4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\554B4465433438F4FF7B8D7AB981B555.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\555E8EEF9A21E3F26C263316A778E15F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\55B1D144C8C3666C687E454A80906ECE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\563EAFFF3BF92CE3F60EAEE4EB18BBB3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\568257F0F7CB54EB479EA5E39A4ACD57.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5731B1CD62369AA3EF2B861A7BACB2C5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\57985F4723464E47CF133A601D28906D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\58766C70A633CC3A5AC9393E175CA63A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\59481CB78111FB31D37EDAC9647FAFD8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5960F40D2AAABA9E743AFA7294468C25.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\59A5343CF85A83AE1E7B5EAFC71ABD66.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\59C780751B7740A822CCE33528AC1E14.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5A7BC66EEC954487F6D9911DEAF052BE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5B18367075FE563AF4A12EA837278D84.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5B4B75183FE97E2D052EE74E519015F4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5BE557A291C3EEB7FE628D8099DD0CD3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5C704EA3E7D7B64E50D00711FC13CD34.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5C81F6E368BC71D1D45E2D9206EA3FD0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5C8CE9E608C8192171A5B93767FCC960.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5CFEE986112963509926EC8912E14D25.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5D75A4D5A6D14E6061698FB7BED0446A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5DFFB5C73CF04EE22E19BB74127846D8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5E69759D567F673B36A59095A347BF07.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5EEE7ED3AD74F7D10B2058BB7C19B751.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5F037A89915D44B8819F9FCFDE0B489E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5F08E2D70EBF81C77FA4C99A0901A6C8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5FC405F33502FCF8B5292EFDDD9AE4FA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\601C41633EC4EEE1FFE41D65491BABD5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\60B3B69ABC4366405469AA15F5B33006.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\60C90B334F5FD0AD576CC5FFCECDFA9C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\617D2BAEB248E81618E2D9342B7323AD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6199F396C445A25AF1DE1CEFFF072560.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\61D0174ACBF8E43615E6DF8019C0583E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\627EE3812DC7A5BF704C057D238F75AA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\62FE034F36B9ACAF125049C4EB64D6A7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6340973172727B5EBAF0A64E92C26B73.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6364E8D3F688917ECAE1050954B63674.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\63B2501D71A2DE162EA12C3CACF8C488.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\644B35DCD280DC69AED674005133C98E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\64B4796A957F50D8E37415358DC4011F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\64BE228C7C03C2D993371E5195306859.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\652B32EA4449A9E8AF422E70ACDF46E4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\653734ED42B7A9B62F119AAB8C9521D8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\657F8341C743B485575944BF32E0125B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\65DE946825EFC13018FEB489315181A4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\662DD1E431BC9D4EB784D7D662BF5114.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\66501D267ABECB2CF3315642D1881501.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\66B28EEE188E29399051A60BAF92D333.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6717E3CAA50A3943B61329778C1DD781.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\671DBBDEA9073F2E4CCCFFF6957044E0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\674888C18C2BA74E9DE8F74501330DC0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6780F8CDE9A603E0A830C9603F2F4D0B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6808D4839451264DD18BB2454D45479E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\682277A939A770BB800CFE4F205D7891.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6874681F627A133631133FDFA2B4FB8D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\687CF9D31E514545A07747EE9CC567AB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\68882E3FA69BD52620343D172BE84815.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\693BB2D22B37188C506A30563317E1D8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6984662FE0A2CC634E49E525D17376AA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6BCCCB82E5792A665667D7E41CC45168.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6BFD34C0EBE9B3A34F525B51261858DF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6CBA7FE164696851E3674A4FC046F926.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6CC07C0289722A5549B9C30F76C249FF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6CC685AEFC129C8DD86F9036F17E943C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6CD4AC2A2B648ABFE8F2F90A5D07829F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6CDB91CE30082B98FE1BEE23E422804C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6CE4D05BA5B97F5FAAA40312E14F0E81.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6D15B1C3AE92D91DCD86360CCC4F53B4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6DADEFFF2FCEDD93F8CEF59036FEF4B9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6E5FACACD2BA0A27C7AE761291F7BED1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6F2F026E4006B8443E4D6AD8DC43B8EF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6F606DA76B5A34FEC3A95B874DC14C2F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\70121DE772621FEB6480A1C9A3475D5A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\70138AC07076B005E1CFA39BC5BD9175.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\71E680EC580A0039A775A378ECD836FF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7282BB1A61AFF7E0656732EE80CEB6FD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\732BD24D0DF3B5E7191B301E55CDD6D6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\738F657B98502C3F07A67FDC669EB8AB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\739CB6904442C4B4092104AACB73DBB0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\73C8F1FE9282D72F1684DA13FF1346AA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7402D0FB5599777D401744FC6DD201D7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\740FBFCE4E4515C86E8C7E9D18A58DF4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\742B2F1B414C6E566B6BDF87D12D8AA4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7450D0DEE62770FF1E5C905B1BAFD42E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\74AF2F8E62D0745F958B573494C439C8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\74E621F5E9C4849D83DAC55AC565A76B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\757421178679BC54A733A7C4F3DAA07B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\75B8AD308277AE2AEFCDEA0B6A7C3C0C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\75F3B2B3A615155BFB2E7C19531A197A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\76118EA7CDB4BF4005AD84DDF6CE2E66.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\76367CD152E34AC3DD8007741C968AF4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\76A3CA62703735BDC186B9056247C8F7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7716BDB243C38A4A24E728B3817AE0F1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\77E1FE7C589B0FE237874F7EE517A0C1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\785C9F9CED5D122AD92D6BC91312F7FC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7891546B010C902B9C8DE33F55F71498.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\78C249F8A099AEA6A25F33F09F50FB47.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7950D68C8C6F669B94D3E488F0B6BEAB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\79EF8F616077A833BE2747809180BFA5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\79FE6B25E5B132F33880B7F44A66B758.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7C6FCEE9F64D2CC890D867AB97DEE424.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7C7E3220AE92EC87E0436ADE3F5D9931.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7D1DA389789509D61D1AB66097581992.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7D60FA9CA39C59A4B7C96DEFCF0B1B01.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7D8C933AA5FE34FA3316DA4B6E09E654.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7DD87359B51EDB79AC235F97E726EF5A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7E12C6950CA7714D731D5313649CA457.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7E19C857E35FA8D70E57B0F1CB21E5C7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7E856BB33FFDA1141B90AC29735FB9FA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7EAB83B6B5BC37690D2D1B3E22DF7D9E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7F3DC6EFFFDCCEBC37B17C2FDC124638.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7FAB1F3A2B36D6EA27A3DB4EC39C7BD0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7FAC187A43CA71A854CA4653D8E075B5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\80064700E82C89F9D3E945021BA8C32C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\80571CB6E9439E1C98BA9AC3FA28D3A9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8096010E847A7DE3A3F69A61002DD563.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8151A5CF9B90099D16EDB3EADE4C8CD3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\818B866A009B1338C5AC103B2D8E2372.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\81FCAC08918AF581FDCB45931E356981.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8243D67DDA3785DAD59ACF70CFC203DE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8266DC592F01723A90239C659F1FA6C7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\82DA351296066664DEB012FCCF6D07AA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\82DA415A8C75204A2D758E6DAD53BC36.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\82DFEA0FE38074528C86FA0695FC7E37.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\82FED0C3319594CCF4117CB3B34B5F72.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8349431AF468BA55DBFB84FC50CC17C5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\83E1D5D490B9335941305F44058A6755.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\843980BE43ABA52AC77C57DF068D59B1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\846AC8E6E788D5BDCFBB697A233A8993.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\84BA101DF0936E1318EE1EB10539C9CD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\84EBC179129822B0E00C47B7528F1FDC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\84FD82C473BCBDEA6CFCD53DF80D6022.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8588C815441547988C5E4B9CC6CF7351.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\85917F125E29280A85EDFCDC3B0C8170.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\868B5F1DDD5C341C50C0D359CD22F37B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\869B30EA34E0F5E56CCBB130AAC2BFA1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\86CAC2AF84F4546D81A07C72C8591F6A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\86F4330E57637679ACB9F17E5F9481D1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\86F83A7235F3DC2A6FCDEC052E1E1C74.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\87218B3AEA759A53DCCA78D6B9BBC66F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\875B0EAE58DBE30E13A8DB610457D0AD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\87C0585DEAE72716889B524A66D1B5A3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\886EC825992F9DCB7AF34306DA80E12D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\88C20208CDD4638C0381F2B7EC657564.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8935BD8F59955F30D52E141E311891AB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8999FA8F96032A452671DE654F9BAD9C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\89FA1168564BA2D42E7C412972B44BB5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8BA44FC08995F15033A9F5D56C8BFC72.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8BC8F7B477D3C6C3184AD0372AEE53F6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8BDE235F11AF9276AB26638F45341094.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8BF0E140F8F40D230143B569A1BAE507.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8C11323D7C773C8A79C1C61EB62FE331.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8CB4C42331F0F4BBCC8E1580131EDCE2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8CBA2BE847D0B28A440C5F24567B0891.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8DB46DD597956632ECDB18D7B2BDF70E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8DB9DE86229327C5777721E4A01FB6B4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8E733CB38D1CDCF7377912244F95A3ED.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8E84BA6D260667ADAAD89BFECDD627CB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8ECBCCCC7B4A9C11EC33A03B6E25EA5B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8EE122F840F244E3AE065AF9ADB16CCD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8F07ADF9734C090207F52CC2C29F17AF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8F1ECB08E7908F5D543B0D9386C0EE1B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8FAA7CD5955A0D5862A90FAA2B0A56F4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8FCABF54BDCC2D55C8203E3B81BAC5FF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\901B1F181D1D82C168094975DEFB52F3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\902F9B116F0B37B699E9A1D4BB1E2784.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\90B516E096C71C814FF03EE3F4B20042.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\92EFA8432E609D6F315DD0A3CB41E1E8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\930C5E176BA9A3D78B730BC00CDDF64E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\945C37C794BCB294DBA8E445FF2C9DB6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9476FC534A628F39C9E25CA2F2B7B45E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\94D3468248838C60F808E50FC66A40D0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\953349B5ECB359DD058D07088EA31408.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\95C6129A16411671ED974764CC24C800.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\95E06CE9FC028717015354732A36A6C1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\960C76B3B2B322906970277571EF6F3C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\966B95F249EDF54D9BE98C23AD9B758A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9694C920807304FD0F9730304298FBFC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\96E2369FBCFC254F09B1EA2AF6E7641A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\97479A7EBC4B4FA9A0F0C7EF9A25471D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9772382673B9BD1FECD8DED342DC39F8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9787DADF23D03D83A63DC8237E63E3EB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\979FEF94607A8F13E19684C45FAA30EE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\97C10655E91CC076C4E294C0127D974B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\97D74F86BDAAADB7B4674A2E199ED992.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9823053171CF53F4038B0801004F87BC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\98A650FE1443CF2F953B6628EE432373.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\99BB0F4219E2381969DCE76BF639AC68.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\99BFB05D8CE546325B5205C32233A3BD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9A977B776702BB9FBB29D1FCCF5F778B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9B0C875B0F6F2F48FB2B5C587F50979C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9B1ABD0CEAE78416529CB8D77CEE7B3A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9B75C712017ED3DA97BEA0D4949BFA74.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9B7AE939DC5E63135058FA28EB025C7C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9B9501A9E26093612D20F39A895DA307.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9C1784EBA4E907589027FCF72DE4C0AD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9C44AA8B16C47059241530441BCD6DD9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9C531048714B59E157A371D1186F796E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9CFE6E9E20D61400007C08E31ED048B4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9D40E5B032950BC9770539F90AD86275.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9DB628ECA9373F2BA3BCBB592AF60665.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9DEA7F87EAEC9FF8770E55D5A6D8CC91.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9E8B373EB1451CC4B43C871707D12D3D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9ED719089FF4652F4929D88C64B6A1AD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9EF608904C4706610FDA20D08530978E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9F39E54D6756FE5D64BB6FED194D0894.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9FC7214EDE76F8AE24F96A8195852557.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9FD6F6552A18165F88BF080B1B4DF1DD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A03E3718C1B8425EB481A1EC4850275F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A067787F4F1B728DE125898181C42609.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A0A63361726BDAE3BC29B11F7526AFE6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A0CC7ED8939B47C1ED00EB9F04D19EB0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A0DE0DD786E0E9020C3DFD7004E42694.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A16EB1FCF4FDFE5542D9FE85FCF4F0E0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A269D70CB8C799952AAD6684D1506485.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A2D118894CA6FCC71ACC7DD86296B7A8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A30FD18C5DC0924B89944F8ADE638E27.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A396597A6767121F681B483A4B28ABDB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A39A3B3270FEF11AE8ACF901E67BE359.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A46C038124134B1482949A1DF8ABB385.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A572284932D45BDC47401871C2E01043.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A5B62AD916B641B7A8365E1C7C9C7544.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A5E0C63B1E67223D493A65CA08D7339B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A71089353F923E1FA26964C3E8153739.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A7463B23BFE582993515A0109F19D304.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A7D7570238274B86C73F2E9009BDF74F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A808A31E629557CF0D5F92D5D87BD706.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A837677C21EC0ECFEB9B10CCD2FEB0E5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A88BC3FD19AFFF0EF5E5DD4A97F9B953.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A93568B935C29F9AA2B5DC62D4964431.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A945F8B7098A596A55A7303B78BC8CF1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A97B345CDEAABDA620BFB72AD2A07100.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A9FBCB4593D76446A380C3F3421BC2A7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AA10CCACD6B301F2187572F1FD684AC5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AA510EA6AD14A8BE52A7D659281F9BF3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AA6235372BA3751E1E4C601E6263D02E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AA69B9C8BBEB509BBB296FEDD7B5ED23.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AB2AD61FC9800DD5C7751E4270E02730.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AB3EC8C66F16D96107223E8469ACA854.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AB545518DC0F250493CCF5B36A459568.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AB947196AECC60D0365253863489134A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\ABA2825A827A4760BD2251B8B781B271.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AD20F64F9DDBB4AB72E615A132B55377.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AD4ADD965106D211E524A76F9B368A14.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AD6E370A764693BABD73A1B75D243F0B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\ADEE1E4F403A605328D0002B7C6CA9C7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AE25594AECD77BF35F6E794162F4DD77.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AE796E3468AD0D0C250FAA45259E22DB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AE8C8067E61E868B002C481CE87EBE05.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AF451AB4377D22C64822DE9E01B1F4E8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AF45D4D704EA10EA55742D1B3C8C6CE2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AF8191ADF52F4156FF8D54FB39842A54.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AF83007CC746311C7050A636C44C02DA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AFC3C909161915255AC43F522C25B858.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AFD8B7D322EE2A1CB2BAF41EC0ADF626.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AFE689599143A3C959EC6ED84C5AE1F9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AFF15E95C194C0034BFE43E5853DEE63.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B0ABD547895829AB29B56F0812CBB823.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B0C53BEE6C437337AB024CECEE878418.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B10EF7584FC5D16C42403B0CA5BD4DFF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B1FD5C4B728DEE34C2744E42C11D8760.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B250BBA224E8A08823993336C7CB7011.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B25479026E9AAB36CBEBFF51AA0E32B5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B308B28244CE4219C4C6B3315FA83200.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B471CD3F6DA41643CF1F5221FE3E4CF9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B48FFF8D8BB2AE842F6650E8DE95B954.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B54261EAEEB4A0D8DB966E20CBEF7E52.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B551DA824528E06A014274837CB2A9CB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B5DC6196F95A004EDD1453C12599676B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B6752671A157884075FCC12BEDFB4D69.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B67D454E426E9AEB60ED08DCC946B44B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B6AF1E27DD1C8095A2887A3BECBB76EF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B7133C48CF1507759D1561876C9BA27B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B7840CBF63A47839AD6AD9F714E4D9BB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B789D76E1E0DE4569B56F6FE22E05621.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B7DD4F9016C2EF03ADB325C37FC76454.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B845DD492B0CE12D87559CED569DE6B1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B8870014FB74FB540F3C31EA907A2AE7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B9B14FBAD84A7125C53EEE7706842C5B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BA42233C2B9592211C49858860047F3F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BA4AF8E4FEBF32A044146607E11B336E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BAE93F9B141EC7983B2E3379E3E9119E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BAE9A5FB11B68C3A726881B291D669F6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BB9039F6B76054E97E7EFE906C52DE12.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BCB9C29787770EE14EFCAC19CF508F66.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BD557D61619F268BDCEA21C2BDB91514.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BD5A24FC505850E33FAACDC4DBFAD85D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BD818313E410FD46A9F63786A32AEE23.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BD880669B37B14C73AF9195DB3A20F28.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BE8B60428F91B5F96E778F2B2C2832A5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BE8E9D8246C687F5C062F5D47DA1199A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BEB55E5308BFA4DC17987F4D0DF04295.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BEE3F1CC0769E4FD5954E4E649614722.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BF15B53EBA3B9699B34F0453D41230A0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BF7B61BA8D8284B7D0DA637AB41F6C96.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BF7BF74A57B2030A3BB9979E14C311F1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C03089ABF5861ADFD1F7C923D2F9A153.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C08E9222775EF82A98E5CDD931ACC633.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C09DD3CA03ADBEEE3ABD0ADF668D9848.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C0E71AD79C7DB91864FCD17ECFDE1E10.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C1A0E85153900845F7BA78472B952007.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C1A41FBCA25E3E6CC4CD22064882728F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C1D36889746E38D1BC7C314F51AC80E6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C1FA58EA827D44CFBEE4F63536677F65.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C23F41A19D7EC249FDA170C05916CB8F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C25A6E589BBE06A55DB5B350B80152B1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C274B92CA0AA0BC1531712AF28602FDD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C291730B7DFE0290D98702FB8F8B0F1E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C2CD968A064AA98DCC1CC37592A142C7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C304206E30795E3A6539B5DF349C4270.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C39C0F5D0934BAE90B29A93BEADC257F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C3C4860D945FD1716E55A2D7AFA8C55D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C3F80855FDF5A3E423EBABF12EB64064.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C40B30214E633F7974F2729FAE1BC67D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C54E46EF4D4F454E2C3ACD269B67494E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C55F973EDD4E17F6A7CA6F8DC77AC2E8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C599AFA5A6F053BAD70179501868318E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C5A7A3340CB4BCC7A5C994052DAB1A78.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C5E5CB06F45AEA0FE31FFD0A0F94194E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C67614C3E48ABD4BC9E709E2CEB2CE53.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C685465F4F6FC210421DA7E9DD550821.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C687C1EAD6B670CCBAA60909B89F62CB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C70550846DA118E1E660A10136A7ECA7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C77491DD5CBE96FF7C3528A0FD4A1410.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C7999B0462D8EAC32E2ED3A9D0017C97.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C7AD207ED7993A4809373AC7E5784F42.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C8306578B5F0D111675384D271B4DAE3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C87E3190BEFC663A6A04D6D857ABE30E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C890A36E670146004F5FA6D96F4C069C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C98344F72C7B0FA5F30F1BF6877B4E25.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CA1BF3536958E01F710E5995DE6EBE31.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CA519EE48C39BDA3C1538E5565C377FA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CAC0434A24FA3D5F69B4858EAA050C64.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CCFBB6F691A0FA96C5B605CD9D80173B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CD3047E52420EB014D24A73F8DD48F55.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CD658FA16F96D4466BFE68FCE874D955.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CDB59C31DC153347DDACAC08113F8015.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CDC6E4754252FF7D0E8F3C134D265A60.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CDDB319981A500F42CBEC98CD2362007.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CDEEE4A36DD31A28218DBF5A1A529CFD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CE096445AF8F836B82205BD4E80E5A94.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CE7FA5E0DC28E4C7BB0A2AA22DE05392.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CF3C74ACDD4465D23E06A73A9D97DFFD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CF4667947FCFC2F62078D3B85CE7EF10.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D003EAB9BB96C7DF227404C6B2582455.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D02971809B01C7E099D44E7A1436F997.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D04911ACFCA47446EFCB01393D3C3F8B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D05C15A4875D58D36F57187E7FE4496A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D05E5243F9713AD9C0F710C5DE549BE2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D06E9123D0C50409B7B9F35A8222CADA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D0E5935486BD6AD49D80F66B81B985DE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D17469C68898749E23D53128870A755C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D1C240EDA191362672EF6FCCB9725F85.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D2412702F385FCB9E6709FB33EB27BDF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D256B700C202A9389F73688CDED83B7E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D2EF06310A52FBA8DF0B6BDFC0D3C664.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D2FA07FC4043B26B5CB97692C2AAFF12.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D3B2EC2F727A45FED5DC9D6BD0BC833D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D48232953788C625160D278B29B5D73D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D4D422DBE282F1B12C3A82517EB0D59D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D4F56CCD124A6B24576AF721B0282383.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D566F9B651B60AE7D0B5DEBF57A90E35.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D64EE91A31A31FCBEAA727029795B289.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D69C7ED8E3B896ACD98229CB4DC363B6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D6E15C5FE0484F1B1192CEC9DD7DCE6A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D6F45CA88F2F5527EC301A7FA3FF5B8C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D75AD6809E604BB6F018E54A8482C928.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D7B94FF620323D536A3B99CCAA6B78DA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D7E06DA4457A14F49A9A996F22881130.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D8401E2EC2C3AFBC1A21717167BA8734.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D8A32838B23AD6809B3B7858DA93D26B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D8D1C602836BEF743D38740FCA8D4B8B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D92BDDCE5396A2FDB5F2208AE47E7CE1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D9D86DD1D8501C39B4325827BB6F2270.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D9DD8F6664E786227542BCC5FCF66D2D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D9E59C2E17E0CE2AC75DA8E34E9214D0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D9EB7BAFBC23534E43B93A69CFD89687.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DA27AF57C09E80A784709AD6239EA23B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DA54B44152345FC1E1817702B2A34D5D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DA5B702F94B3636728C005C0E5C0A6BE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DA736886F13A0E2EE2265319FB376753.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DAC96F2A49E2484740F118A3CDF28EA3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DAEC8125C10A9D1FB182920A9FDE141A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DB347A2F84FBE8E0965F9BCF8D6FD7E2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DB54C5562A50379EFADA86F9B3861ABC.mof

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\cleaners\Spoofer.exe

MD5 7a4a3fea89bfe8810ef9835273d6fc84
SHA1 cd411d7d4eed7b622ca2d1ea5495055da76216ee
SHA256 2d9b399a3a584808b4bd38d9f6a12752e2b02875f92252f944a5bd7bf129e2f0
SHA512 a921faf7de2ae61421432ba176ef7254f005bc052d41054019d1fbc5714c213266c598a64cd4c3edd4cec35130e3ce8d7595bb2bcc7c669a20d69b0ca93277d4

C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx64.exe

MD5 b4eceb90668db85712e66fd493ce4ca5
SHA1 951f3e9503b9b31a0c944355870dbfea0df32441
SHA256 bf8df68bbac80b4382206917b9bb46e8fd6cf76f6acd7374a3e6f5470681597c
SHA512 b912554fd863b237edd9f6518676ca9a190b7c7dc54024973a6062da8bf5ce8c6ad16219032cb0ed1ade7d2b5a855a6dc2aeb71c0ddde476a8bec64068ba0284

C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx32.EXE

MD5 feac8b5c2d2b99e7a3c8f1ba41ba3472
SHA1 002bd5344c44f288c22e69b5e2846d515bfa429e
SHA256 7fce635cb66dc1286856a1f1f281b90431288be4a9647a8e0cbd2a0346748b95
SHA512 b95b83545ca45453e6d64b7c2cf276932eded9658187aa91dcff948e59c313ae071b0059a481cd7b01aae778fc4fda71aa830fb99b84197fb17e03e9a10e8e68

C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\gsoftgmx64.sys

MD5 f22740ba54a400fd2be7690bb204aa08
SHA1 5812387783d61c6ab5702213bb968590a18065e3
SHA256 65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9
SHA512 ac1f89736cf348f634b526569b5783118a1a35324f9ce2f2804001e5a04751f8cc21d09bfa1c4803cd14a64152beba868f5ecf119f10fa3ccbe680d2fb481500

C:\Users\Admin\AppData\Local\Temp\cleaners\cleaners\cleaner.bat

MD5 0bef79984a785d284e225d3576239802
SHA1 0a759883c5cd8822f269eca241c4dc8c43d86220
SHA256 33da2dd5c5ef66be92bc9024f58e5b967746ff2f4b693efe68e98df7da6d4c80
SHA512 d5d5aa1e7b3a46af0fd2f94eb5c45c451d3dd3a99debfba1fcda4f704dd3bb54d15fe7d4cda84fa5ca049a81115de73a583aa32da35db862ff6f00799f7700ad

C:\Windows\System32\wbem\Performance\WmiApRpl.h

MD5 1cc4c3b9bb1657be77939f0b565e315d
SHA1 6a7ff123e96da6f7fb0fd9b7d7600bfc3540ee25
SHA256 9eb3cbb0f65809845890159efdab0ff5a910da34252e7d5cff2929cc2fa6ab6a
SHA512 fd461013902cf1f89485efc1cbdd07bc294253a1b60d9950e27cdb12937cbb39e3491ddb5dfdc4386df87fa44ee4ca9b3be01d7048850337ff9d68156eea78ef

C:\Windows\System32\wbem\Performance\WmiApRpl.ini

MD5 a656a56b1fda4aa28383160ba6ebea3b
SHA1 bda09bb6f5f28f5470147113e93d46a02853dfe1
SHA256 639cf8acd1fe25a19b9841c9262b4227fcc33bb6658919d31b10ab849253b318
SHA512 fbc74c738bbebb6265688ebec7a6bce18f5a59e98a5417701e5565d5c6e1f8c350da000005fc7441f8a4622043d4a8fd62efe54308cfa59f4ce9ed027dadebae

C:\Windows\System32\perfc011.dat

MD5 eef14d868d4e0c2354c345abc4902445
SHA1 173c39e29dbe6dfd5044f5f788fa4e7618d68d4d
SHA256 9f32176066529c5699d45728fcad1bccce41d19dded4649b49cb24f7eef9ce7f
SHA512 c926f13a0fc900dd7d740e2d7d33cdd1902ece0bfb44b6e1f5fed6ffd348c3e7d71089fb9792e38799e8df6573bc09e67bbe132cf9c2ae0a7199534dc5d959ee

C:\Windows\System32\perfh007.dat

MD5 82d7f8765db25b313ecf436572dbe840
SHA1 da9ed48d5386a1133f878b3e00988cbf4cdebab8
SHA256 3053aa67e9cb37cd6f9645ef3bec8d43b1863afd852d3860ea73fcd83c7010c3
SHA512 59766b408b548dc020b54c79a426b361112c33c7263c16ca2e69485dadca05fb4c63b6433063e77c6a9e28a43ec6d3c8206ea702a33b79151fa6309d83b316a8

C:\Windows\System32\perfc007.dat

MD5 1bd26a75846ce780d72b93caffac89f6
SHA1 ff89b7c5e8c46c6c2e52383849bbf008bd91d66e
SHA256 55b47d0f965800c179a78314b6489d02788a44fa2ce00f68b2d860440216927a
SHA512 4f5e14637e9e89700f1ee2d0e575d26d4f3d164d859487f1471bf4410dec6d0d7dbf552c6f791c12388be035c6b974610cda8882c6394438e2220b79e4d74e9e

C:\Windows\System32\perfh00A.dat

MD5 4e62108a0d4a00aa39624f4f941d2595
SHA1 7fbff1d3ac293c715a303ac37da0ceb12591028b
SHA256 3df3adaa8bd1ec4dd99bf304c7a1b0d513097fbeb8648efad4b127c5522c3263
SHA512 c79a483e4012d8c97f4a2188fdc27ea04bae24993b12487551872f1413a1a0884197dc71d13ba1dfd32c9b2c93089761f6f3ec37f0bb19e209dbf19283462126

C:\Windows\System32\perfc00A.dat

MD5 6d4b430c2abf0ec4ca1909e6e2f097db
SHA1 97c330923a6380fe8ea8e440ce2c568594d3fff7
SHA256 44f8db37f14c399ea27550fa89787add9bfd916ffb0056c37f5908b2bac7723e
SHA512 cf28046fb6ab040d0527d7c89870983c02a110e9fe0ecf276395f080a3bd5745b920a79b3ce3bb820d7a5a878c0d13c37f67f4b5097245c5b93ca1111c1e830b

C:\Windows\System32\perfh009.dat

MD5 407f4fed9a4510646f33a2869a184de8
SHA1 e2e622f36b28057bbfbaee754ab6abac2de04778
SHA256 64a9d789cc9e0155153067c4354e1fc8baf3aa319fa870a2047482450811f615
SHA512 1d420ea7ac787df81bbc1534e8fac89227f54fffff70c08c6d2da385762e6c5766448ab4a47aae1c5cbc671776522b6fb6d9c27870b505ae101462bce912867e

C:\Windows\System32\perfh00C.dat

MD5 b87c7ea0e738fc61eb32a94fbd6c6775
SHA1 0e730aa70900f623205b93cb1d6e11be4c0d51b5
SHA256 6cd8b09f644b22c39e02af26b57580baa0fbed01b682d158b29c676d17dac5c0
SHA512 4bad64af992b17a5700cf25ccfa299b2db5be846b8bc28233fa6987964994a34694eb53329ede8d04092298e4b16f06563e459692c210111e0420ee34468f23d

C:\Windows\System32\perfc00C.dat

MD5 6adbb878124fcd6561655718f12bff5f
SHA1 1711619dda04178fb47eea6658da6ad52f6cf660
SHA256 0b16ac631d596f85f0062dbe5da238c0745bd4c033207cba2508465c7c7983cf
SHA512 88ec8b3c4670970900ef8fdaf0865e24a5bbc9c0ca375eb6ce12e8d8a3ec08c8a45dfc8ae3c7f4ff1974d5e4b53e0905c5dffadb852e730eb8097a22cd750006

C:\Windows\System32\perfh011.dat

MD5 906500b906ff5714abfb310609a6207e
SHA1 e085597f06df2b986f482f37d6077247d76c0cba
SHA256 82df03abd566227a4ec99ceae023f79d5886e93b425ecc4a54f53452593f60f1
SHA512 54c5b7cc290aeb34c93c7c1301d90aac2a1190d6e92893b86264682d91930df9e91c644a00c566841031efc3a0c71322106b8c1ce679e026930094c778e77b96

C:\Windows\System32\perfh010.dat

MD5 af84da8efc4350425986bd8d1f9e4aa2
SHA1 d475f5d5003d2152d8f9d976fd762b474e0857fc
SHA256 802e68c2a17427e31589ee76fba78534fa56612d7b20dcdba0c468b06be13e75
SHA512 6ef39476f69635ef1891deb43f251f4077030b3478d771409c84940f9f6128ee4850ee04687cda923816421935ba3cd06ca3e381a3af9e3e17f105f5aa9fc7c6

C:\Windows\System32\perfc010.dat

MD5 d4b57c62c54e6f62c2239177730248d8
SHA1 7d81fe1eac0d666aaa01064cbcdf51c1d44db819
SHA256 7fb738ffc037deb30ac1aa843af1dfed6772fcae0055e409ff6f5cd7b651716b
SHA512 9939e6835587f814ab575a4ba616f151ef649bac79b207b3536fe38228ebfd55ce50d1bd17d4dc3c11aefc8d421a7c20bee13ffc4a314915a7e50a5e4ce13e6f

C:\Users\Admin\AppData\Local\Temp\cleaners\cleaners\applecleaner.exe

MD5 f96eb2236970fb3ea97101b923af4228
SHA1 e0eed80f1054acbf5389a7b8860a4503dd3e184a
SHA256 46fe5192387d3f897a134d29c069ebf39c72094c892134d2f0e77b12b11a6172
SHA512 2fd2d28c5f571d40b43a4dd7a22d367ba42420c29627f21ca0a2052070ffb9f689d80dad638238189eed26ed19af626f47e70f1207e10007041c620dac323cc7

C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\CupFixerx64.sys

MD5 2b3e0db4f00d4b3d0b4d178234b02e72
SHA1 622e7bffda8c80997e149ac11492625572e386e0
SHA256 8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9
SHA512 8f200a2e13aa8a977c94509af5a0fe20e7964a7611e11aaa5ecd5aba73a60275f6f57ed3a6861b82832babfcfe5ec90f0c9067c65ef48f6c7fce69f7ad87baff

C:\Users\Admin\AppData\Local\Temp\cleaners\spoofers\serial_checker.bat

MD5 0c088b6adc55c20fc375badef6f7e9a7
SHA1 37c865ebfe537b94534844281e9086462f3e2462
SHA256 51f783d41ad3a807344eb9550d65cb4638793aac71f4eb4a1a11414b24e339e1
SHA512 7f82c647413f997a537148ab7d1e8a5cff9fef18561783f329485dbb67ab76a2a8defa0a7304feb7e1e79645b50b8cb2d4a069ff3ec668542fdefb1adbde6f5d

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 09:26

Reported

2024-06-20 09:32

Platform

win10v2004-20240508-en

Max time kernel

269s

Max time network

255s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"

Signatures

Cerber

ransomware cerber

Disables service(s)

evasion execution

Server Software Component: Terminal Services DLL

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Winmgmt\Parameters\ServiceDll = "%SystemRoot%\\system32\\wbem\\WMIsvc.dll" C:\Windows\system32\regsvr32.exe N/A

Stops running service(s)

evasion execution

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\wbem\AutoRecover\9C531048714B59E157A371D1186F796E.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\217644A70D97280C86378D1CA26B7AA2.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\68C988E8745EC6E36E3E1E884DF0C7E7.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\A60FBD091009A589C874DA4693F600B8.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\AE802654B765CC48ADF1776E029127AD.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\0A49A422B8A92BD87756E892C1BAEC38.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\EDB534A0AD75CF6CD3441C25046B8E9A.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\081DC4459A960141A0EEACEA91564095.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\2DFDBD25A9B159E6B632A69ADD81F446.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\766316F4B9D43FD9AA9173DEF173E8B3.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\49570CF88DED3D22D2855A44F0FD36EC.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\7223A99D5F3B83EF1F39C9119D226C65.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\73C8F1FE9282D72F1684DA13FF1346AA.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\90BB0EFE8D43C5A30EC9AF2BE78876F3.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\924FDF9D3DAC3D1B59BBDE6B39480F9F.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\ECB21C06722B77DF3BBCA06F061758DE.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\3F78FC5E2CC6CFD8720C796D34A544F7.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\939A1CCD9B96A1AF3210F009D2E03D9D.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\476C3FD56A0D8BA1E9A4920B9C079DD6.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\EDF3F610F6DA16B8F758D81ADD6764AC.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\77AF494807BB41A0B4B67AEEC51F85C6.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\98159F48A88CD01E027D3D99D9BCC62D.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\1753193BD187ED10233F6F3065CE44CB.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\EAE731B1CFFF749C3A1B72EF0CEC7C59.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\AA742824DCADA846BA4B665D686DD5D6.mof N/A N/A
File created C:\Windows\system32\perfh011.dat C:\Windows\system32\regsvr32.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\88744D2A29102FC88ECF505DD2E984FC.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\DD4F35C43D8461F661FEDE2A996C5CDC.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\B7F67BD50365854FC87ABBD6B4A39E34.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\5B5D21CF62E70BACF9D085E6AA6CE143.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\FB714E1BF2620BB75955FEF9EAAF5621.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\044172E3DAE76A1C771B29EC2B295D42.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\D180543365AB25F07DA7D041BCBC092A.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File opened for modification C:\Windows\system32\PerfStringBackup.INI C:\Windows\system32\regsvr32.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\327BB52C3180F103242F79F3FB946560.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\7D6762D992FED97423BDD43CEB0146A0.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\B6C73E699C04F876FE75CE460B046079.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\44B3D4F6C97B96195C4E695CF9CCFF6B.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\948C4E38F6DA5FBC241D94FA908444EE.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\FC4DF9001B20616C9CB1D98663B7AB78.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\2E396EEE862060CD28A5E93C2630828C.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\87AA2A001CE3E89926688B93E4DC2992.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\03E20F6C54427A7C0DDEE97EC0898FAB.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\1BB509370478719A04E9FD51BAFC9C0A.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\A9A4EE41F6FB98DC29B3BA149DCDC8AD.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\E99F6A473E9EDAAB6DBDDB1F25B49CB5.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\73798C03E4DE5FDCF5194ADA9EBFB859.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\EF1A7FB7D27AFD12DE0E12A4FCB47DE6.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\0E68BDAB79C00E0C496F8772703BB3AB.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\BA837B4A6595269F3B4802501AFF1DAE.mof N/A N/A
File opened for modification C:\Windows\system32\wbem\AutoRecover\1364A1ACC2D182FC0E95C7573ADD0308.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\D91E4EE4235CB0BED15CC18ED636C063.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\3E2EEA84B9C48DACD55F3E7EF12AC696.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\37134956F76D3C30C9BE0C12571CAF43.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\98B6513D1BC603A913FD041CE8CCDB7B.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\2705E5F8DB40B47DAFB3CA49131E5E9D.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\1014C7426F83A5E8FFB470C4DEF93C6F.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\7860AE0397A01CCF77E6AA4B3D21D60D.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\1DC273D2A3B26F16F8BD60B431352CC2.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\F5F43931E595A33D648F1A287C5CADF7.mof N/A N/A
File created C:\Windows\system32\wbem\AutoRecover\AA44637A243C8CA317FA500EB39EAFDF.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\C6300BFE37ADE6B52EC023F66124985F.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\C97C2E2B7E9A6C6CC6570EFC0E353900.mof C:\Windows\System32\wbem\mofcomp.exe N/A
File created C:\Windows\system32\wbem\AutoRecover\E4C73E1C841358E20E73C604BFA1247D.mof C:\Windows\System32\wbem\mofcomp.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.ini C:\Windows\system32\regsvr32.exe N/A
File created C:\Windows\inf\WmiApRpl\WmiApRpl.h C:\Windows\system32\regsvr32.exe N/A
File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h C:\Windows\system32\regsvr32.exe N/A
File created C:\Windows\inf\WmiApRpl\WmiApRpl.ini C:\Windows\system32\regsvr32.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6919DD07-1637-4611-A8A7-C16FAC5B2D53}\NumMethods C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD450835-CF1B-4C87-9FD2-5E0D42FDE081} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JobObjectProv.JobObjectProv C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\Version C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CD184336-9128-11D1-AD9B-00C04FD8FDFF} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\NumMethods C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JobObjIOActgInfoProv.JobObjIOActgInfoProv.1\ = "Win32_JobObjectIOAccountingInfo Component" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\NumMethods C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{37196B39-CCCF-11D2-B35C-00105A1F8177} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A0DC377-A9D3-41CB-BD69-AE1FDAF2DC68}\NumMethods C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7016F8FA-CCDA-11D2-B35C-00105A1F8177}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55F7B88D-A254-4B22-B7BB-FCDBBA1AFA32} C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55F7B88D-A254-4B22-B7BB-FCDBBA1AFA32}\Version\ = "1.0" C:\Windows\system32\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0C0B0642-1DEB-43DF-8032-7A9BF5811A74}\Version C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WINMGMTS\ = "Wbem Scripting Object Path" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1B9E04A-3226-11D2-883E-00104B2AFB46} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA70DDF4-E11C-11D1-ABB0-00C04FD9159E} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11CAA957-4E80-474E-A819-7FD72148ADA9}\ProxyStubClsid32 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\ = "Win32_JobObjectLimitInfo Component" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1108BE51-F58A-4CDA-BB99-7A0227D11D5E} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6DAF9757-2E37-11D2-AEC9-00C04FB68820}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266C72E6-62E8-11D1-AD89-00C04FD8FDFF}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E} C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0C0B0642-1DEB-43DF-8032-7A9BF5811A74}\InprocServer32\ = "C:\\Windows\\System32\\wbem\\Microsoft.Uev.AgentWmi.dll" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2FEEEAC-CFCD-11D1-8B05-00600806D9B6}\InProcServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E246107B-B06E-11D0-AD61-00C04FD8FDFF} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A571F412-E3D2-4A32-BF42-1D3B2203FF17}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC231970-6AFD-4215-A72E-97242BB08680}\TypeLib C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{6D7A4B0E-66D5-4AC3-A7ED-0189E8CF5E77} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0AA9D93-2EF5-47FB-960C-F90FC644B48E}\ProgID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1E9C5B2-F59B-11D2-B362-00105A1F8177}\ProxyStubClsid32 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv\CurVer\ = "JobObjLimitInfoProv.JobObjLimitInfoProv.1" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A571F412-E3D2-4A32-BF42-1D3B2203FF17}\ = "SettingsLocationTemplateProvider Class" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A571F412-E3D2-4A32-BF42-1D3B2203FF17}\TypeLib\ = "{0438D53A-9A57-423C-9E54-9612C4576257}" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F55C5B4C-517D-11D1-AB57-00C04FD9159E}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E246107B-B06E-11D0-AD61-00C04FD8FDFF}\NumMethods C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F55C5B4C-517D-11D1-AB57-00C04FD9159E} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED999FF5-223A-4052-8ECE-0B10C8DBAA39}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FB1D98A-F895-4761-8DC2-774969C84D10}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92B9503D-19C3-4181-9F42-57FFC1A4BF37}\ProxyStubClsid32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3E41207-BE04-492A-AFF0-19E880FF7545}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\NumMethods C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC9072AB-C000-49D8-A5AA-00266C8DBB9B}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{1860E246-E924-4F73-B2C5-93E0577E3AA1} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WbemScripting.SWbemSink\CurVer C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WbemScripting.SWbemLastError.1\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3DD82D10-E6F1-11D2-B139-00105A1F77A1}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{755F9DA6-7508-11D1-AD94-00C04FD8FDFF}\ProxyStubClsid32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\WbemScripting.SWbemLocator.1 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\ProxyStubClsid32 C:\Windows\system32\regsvr32.exe N/A

Runs net.exe

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\mofcomp.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3952 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer.exe C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx64.exe
PID 3952 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer.exe C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx64.exe
PID 3952 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer.exe C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx32.EXE
PID 3952 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer.exe C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx32.EXE
PID 3952 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer.exe C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx64.exe
PID 3952 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer.exe C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx64.exe
PID 3952 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer.exe C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx32.EXE
PID 3952 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer.exe C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx32.EXE
PID 3952 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer.exe C:\Windows\system32\cmd.exe
PID 3952 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer.exe C:\Windows\system32\cmd.exe
PID 3952 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer.exe C:\Windows\system32\cmd.exe
PID 3952 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer.exe C:\Windows\system32\cmd.exe
PID 3052 wrote to memory of 1280 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cacls.exe
PID 3052 wrote to memory of 1280 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cacls.exe
PID 3052 wrote to memory of 672 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 672 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 4136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 4136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 552 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 552 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 3600 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 3600 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 1600 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 1600 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 4848 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 4848 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 3372 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 3372 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 2524 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 2524 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 3772 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 3772 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 3840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 3840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 4836 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 4836 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 2900 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 2900 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 3908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 3908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3052 wrote to memory of 956 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 3052 wrote to memory of 956 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 3052 wrote to memory of 992 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 3052 wrote to memory of 992 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 3052 wrote to memory of 4872 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 3052 wrote to memory of 4872 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 3052 wrote to memory of 2096 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 3052 wrote to memory of 2096 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 3052 wrote to memory of 1480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 3052 wrote to memory of 1480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 3052 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 3052 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 2520 wrote to memory of 1856 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 2520 wrote to memory of 1856 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 3052 wrote to memory of 3044 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3052 wrote to memory of 3044 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3052 wrote to memory of 1664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\regsvr32.exe
PID 3052 wrote to memory of 1664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\regsvr32.exe
PID 3052 wrote to memory of 4228 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\regsvr32.exe
PID 3052 wrote to memory of 4228 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\regsvr32.exe
PID 3052 wrote to memory of 4592 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\regsvr32.exe
PID 3052 wrote to memory of 4592 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\regsvr32.exe
PID 3052 wrote to memory of 1208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\regsvr32.exe
PID 3052 wrote to memory of 1208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\regsvr32.exe

Uses Volume Shadow Copy WMI provider

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Spoofer.exe

"C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4624,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx64.exe

C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx64.exe C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx64.sys

C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx32.EXE

C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx32.EXE C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx64.sys

C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx64.exe

C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx64.exe C:\Users\Admin\AppData\Local\Temp\spoofers\gsoftgmx64.sys

C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx32.EXE

C:\Users\Admin\AppData\Local\Temp\spoofers\CupFixerx32.EXE C:\Users\Admin\AppData\Local\Temp\spoofers\gsoftgmx64.sys

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\cleaners\cleaner.bat

C:\Windows\system32\cacls.exe

"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"

C:\Windows\system32\taskkill.exe

taskkill /f /im epicgameslauncher.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im FortniteClient-Win64-Shipping_BE.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im FortniteLauncher.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im OneDrive.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im FortniteClient-Win64-Shipping.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im EpicGamesLauncher.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im UnrealCEFSubProcess.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im CEFProcess.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im EasyAntiCheat.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im BEService.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im BEServices.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im BattleEye.exe

C:\Windows\system32\sc.exe

Sc stop EasyAntiCheat

C:\Windows\system32\sc.exe

Sc stop FortniteClient-Win64-Shipping_EAC

C:\Windows\system32\sc.exe

Sc stop BattleEye

C:\Windows\system32\sc.exe

Sc stop FortniteClient-Win64-Shipping_BE

C:\Windows\system32\sc.exe

sc config winmgmt start= disabled

C:\Windows\system32\net.exe

net stop winmgmt /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop winmgmt /y

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c dir /b *.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s appbackgroundtask.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s cimwin32.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s DMWmiBridgeProv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s DMWmiBridgeProv1.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s dnsclientcim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s dnsclientpsprovider.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s Dscpspluginwkr.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s dsprov.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s EmbeddedLockdownWmi.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s esscli.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s EventTracingManagement.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s fastprox.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s ipmiprr.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s ipmiprv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s KrnlProv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s MDMAppProv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s MDMSettingsProv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s Microsoft.AppV.AppVClientWmi.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s Microsoft.Uev.AgentWmi.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s MMFUtil.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s mofd.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s mofinstall.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s msdtcwmi.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s msiprov.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s NCProv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s ndisimplatcim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s NetAdapterCim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s netdacim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s NetEventPacketCapture.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s netnccim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s NetPeerDistCim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s netswitchteamcim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s NetTCPIP.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s netttcim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s nlmcim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s ntevt.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s PolicMan.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s PrintManagementProvider.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s qoswmi.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s RacWmiProv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s repdrvfs.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s schedprov.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s ServDeps.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s SMTPCons.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s stdprov.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s vdswmi.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s viewprov.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s vpnclientpsprovider.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s vsswmi.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wbemcntl.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wbemcons.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wbemcore.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wbemdisp.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wbemess.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wbemprox.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wbemsvc.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WdacWmiProv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wfascim.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s Win32_EncryptableVolume.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s Win32_Tpm.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WinMgmtR.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WmiApRes.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WmiApRpl.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WMICOOKR.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WmiDcPrv.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wmipcima.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wmipdfs.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wmipdskq.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WmiPerfClass.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WmiPerfInst.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WMIPICMP.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WMIPIPRT.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WMIPJOBJ.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wmiprov.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WmiPrvSD.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WMIPSESS.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s WMIsvc.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wmitimep.dll

C:\Windows\system32\regsvr32.exe

regsvr32 /s wmiutils.dll

C:\Windows\System32\wbem\WmiPrvSE.exe

wmiprvse /regserver

C:\Windows\System32\wbem\WinMgmt.exe

winmgmt /regserver

C:\Windows\system32\sc.exe

sc config winmgmt start= auto

C:\Windows\system32\net.exe

net start winmgmt

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 start winmgmt

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c dir /s /b *.mof *.mfl

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\aeinv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AgentWmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AgentWmiUninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\appbackgroundtask.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\appbackgroundtask_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AuditRsop.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\authfwcfg.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\bcd.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\BthMtpEnum.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\cimdmtf.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\cimwin32.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\CIWmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\classlog.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\cli.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\cliegaliases.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ddp.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\dimsjob.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\dimsroam.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\DMWmiBridgeProv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\DMWmiBridgeProv1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\DMWmiBridgeProv1_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\DMWmiBridgeProv_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\dnsclientcim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\dnsclientpsprovider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\dnsclientpsprovider_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\drvinst.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\DscCore.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\DscCoreConfProv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\dscproxy.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\DscTimer.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\dsprov.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\eaimeapi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\embeddedlockdownwmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\embeddedlockdownwmi_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\EventTracingManagement.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\fdPHost.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\fdrespub.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\fdSSDP.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\fdWNet.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\fdWSD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\filetrace.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\firewallapi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\FolderRedirectionWMIProvider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\FunDisc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\fwcfg.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\hbaapi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\hnetcfg.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\IMAPIv2-Base.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\IMAPIv2-FileSystemSupport.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\IMAPIv2-LegacyShim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\interop.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\IpmiDTrc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ipmiprv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\IpmiPTrc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ipsecsvc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\iscsidsc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\iscsihba.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\iscsiprf.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\iscsirem.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\iscsiwmiv2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\iscsiwmiv2_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\kerberos.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\krnlprov.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\L2SecHC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\lltdio.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\lltdsvc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\lsasrv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mblctr.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\MDMAppProv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\MDMAppProv_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\MDMSettingsProv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\MDMSettingsProv_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Microsoft-Windows-OfflineFiles.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Microsoft-Windows-Remote-FileSystem.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Microsoft.AppV.AppVClientWmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Microsoft.Uev.ManagedAgentWmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Microsoft.Uev.ManagedAgentWmiUninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mispace.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mispace_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mmc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mountmgr.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mpeval.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mpsdrv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mpssvc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\MsDtcWmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\msfeeds.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\msfeedsbs.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\msi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\msiscsi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\MsNetImPlatform.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mstsc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mstscax.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\msv1_0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\mswmdm.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ncprov.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ncsi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ndistrace.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetAdapterCim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetAdapterCimTrace.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetAdapterCimTraceUninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetAdapterCim_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\netdacim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\netdacim_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetEventPacketCapture.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetEventPacketCapture_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\netnccim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\netnccim_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetPeerDistCim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetPeerDistCim_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\netprofm.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetSwitchTeam.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetTCPIP.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\NetTCPIP_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\netttcim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\netttcim_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\networkitemfactory.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\newdev.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\nlasvc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\nlmcim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\nlmcim_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\nlsvc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\npivwmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\nshipsec.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ntevt.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ntfs.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\OfflineFilesConfigurationWmiProvider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\OfflineFilesConfigurationWmiProvider_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\OfflineFilesWmiProvider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\OfflineFilesWmiProvider_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\p2p-mesh.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\p2p-pnrp.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\pcsvDevice.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\pcsvDevice_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\PNPXAssoc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\PolicMan.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\polproc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\polprocl.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\polprou.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\polstore.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\portabledeviceapi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\portabledeviceclassextension.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\portabledeviceconnectapi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\portabledevicetypes.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\portabledevicewiacompat.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\powermeterprovider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\PowerPolicyProvider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ppcRsopCompSchema.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ppcRsopUserSchema.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\PrintFilterPipelineSvc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\PrintManagementProvider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\profileassociationprovider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\PS_MMAgent.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\qmgr.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\qoswmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\qoswmitrc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\qoswmitrc_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\qoswmi_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\RacWmiProv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\rdpendp.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\rdpinit.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\rdpshell.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\refs.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\refsv1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\regevent.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Remove.Microsoft.AppV.AppvClientWmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\rsop.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\rspndr.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\samsrv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\scersop.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\schannel.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\SchedProv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\scm.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\scrcons.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\sdbus.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\secrcw32.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\SensorsClassExtension.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ServiceModel.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\ServiceModel35.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\services.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\setupapi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\SmbWitnessWmiv2Provider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\smbwmiv2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\smtpcons.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\sppwmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\sr.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\sstpsvc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\storagewmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\storagewmi_passthru.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\storagewmi_passthru_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\storagewmi_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\stortrace.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\subscrpt.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\system.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\tcpip.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\tsallow.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\tscfgwmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\tsmf.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\tspkg.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\umb.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\umbus.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\umpass.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\umpnpmgr.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\UserProfileConfigurationWmiProvider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\UserProfileWmiProvider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\UserStateWMIProvider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\vds.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\vpnclientpsprovider.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\vpnclientpsprovider_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\vss.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WBEMCons.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wcncsvc.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WdacEtwProv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WdacWmiProv.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WdacWmiProv_Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Wdf01000.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Wdf01000Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wdigest.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WFAPIGP.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wfascim.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wfascim_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WFP.MOF

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wfs.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\whqlprov.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Win32_DeviceGuard.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\win32_encryptablevolume.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Win32_EncryptableVolumeUninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\win32_printer.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Win32_Tpm.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wininit.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\winipsec.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\winlogon.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Winsat.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WinsatUninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wlan.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WLanHC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmi.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmipcima.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmipdfs.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmipdskq.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WmiPerfClass.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WmiPerfInst.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmipicmp.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmipiprt.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmipjobj.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmipsess.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmitimep.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WMI_Tracing.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmp.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wmpnetwk.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wpdbusenum.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wpdcomp.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wpdfs.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wpdmtp.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wpdshext.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WPDShServiceObj.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wpdsp.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wpd_ci.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wscenter.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WsmAgent.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WsmAgentUninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WsmAuto.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wsp_fs.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wsp_fs_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wsp_health.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wsp_health_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wsp_sr.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\wsp_sr_uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WUDFx.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Wudfx02000.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\Wudfx02000Uninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\WUDFxUninstall.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\xwizards.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\000CA9FCCEA7C766DFE3B6493B9A908F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\016A4FDC29C2CD1C06090D04CC752B4D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\01B65BA66800FEA5CE7F4892966D7559.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\01D083B8F092E9FEF6D9C55A64A75334.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\01EA423F27498C64D3F6C297AE2BD8F2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\020FD1D34279A20EBB3742D63B9E359A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0232BC928C9666E5DB91EC0848F13E18.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0309255AB46E3D6CAE2056340225DDA9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0357610A8F431F78C35A3F00FF8E7E13.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\038145628EF306DCD8FD7686C52BD131.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\03E20F6C54427A7C0DDEE97EC0898FAB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\042E30CED0EE9B02641D0960BD5D6854.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0471EE6D56711CCAFEBCF01C57F9159A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\04920A1D7F20A747256FB48CA8A0147B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\04B1FC5EA475F43F0CF8815E33B5913C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\04D5961EC17DF68D8407B772F9C7DF98.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\050F60C5DEC201482BC14E317519A6F6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\057069C8BCE64220B28DD683690F6879.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0583E7E08D1877A324A2553D19A795EA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\069B498336DCA76D929AAAF5631ED0A5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\06A22D2701E90D7DDCF8AAC0522F2449.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\06DAE99BF3D429EE4946D4BF8BFF8C96.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\06DEE93B2013BBE13958B3FA0D45AEB5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0736061F644ECE849A494F2EDE2008CE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\086D10A6F37ED2F988C9A8EDEF53B707.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\08BF1AF6E61B8456B1D5B42769C3412C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\08D51E934D3BA7EB8F60B6E90B6F1511.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\08F894CB142235B53617974B1893CC74.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\09329A919E0B1FEB9E13BE1D4E8C71B0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0955A3255BE8F939592AA33CBFED6637.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\095DDA6145E278EC67897251831FDD47.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\097C63F5D2B8C4182BEB625A8287192D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\09A251213F70FF824ABB31AACEEAC17F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0A2DA7EA3492D7ECD2C313A8B7490FC1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0A49A422B8A92BD87756E892C1BAEC38.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0A76D835FEE42A0F9B07455539850A30.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0A7CF62821E141ADACC0C287DDD01839.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0B21EB6E1A9BA82714E2C9FCB1DD6E8A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0B7747DAC81B5CDD2893AAE2E4BBE034.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0BE369FFE21F5817AE0847874550D36B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0C0B602529B4AB335EE2B6BDD125ADB2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0C840E79E220554456F582031714D456.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0CB6D8EA6179D949B588A4D328F2A1D5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0CBD6BDA858114EC196F6B41C2CFD3BF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0CCAA8293392639FBA830DD578DB2C02.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0D169F54EB7176F6BF264A5F8562C98B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0DA95863FE4B25CC2D43F0020902CB31.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0DAE6401EA75135DC71C2BF2727AE47F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0DC0A697FFCC592B72AABF89E4FD9156.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0E68BDAB79C00E0C496F8772703BB3AB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0EA772F1A1EDFC2AEE10CC4E22899FA7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0EACEE5F78D8DC364E3C886DBB50601B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0EB7B5521B8E9A713CA5D4DE1135B365.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0EBA1F7B891BD5FE808E91F1D5467AFE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0EBDDF573C99959D239BF0ADB48A18B5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\0F6999175ECAE7FD86A81D5F3AC1FA46.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\100C683F4F92BE5F31DCF9E5E8F8A127.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\105E698CE1AE9FA053B763F2C80120D6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\10D697E74C7A4CC694967A7BA1861EE7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\10EDE1FE24EBC1EBE598FDE3A051CB83.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\11992DCCFDD62BD40E85DA67BD91FF88.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1228A6BDE4139369DF7DB4975C62A50A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\128E25AF26A5FD60EC8421A35FE38114.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1364A1ACC2D182FC0E95C7573ADD0308.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\13BC960D220197BCBCC7F1658C34102D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\153FCFE945068754B72A6FC011B37613.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\160386BCC54C67562570A808003698B2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1641F982282E8CA70B0D93F1F2BB145B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1671EBB4B246E464FCB7369EAB2831EF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\16C850723D6D606824E3600992F717AC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\16E269CB069C7242FB610AB48045318B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\170119984F3AA426567DD71E8458DCA1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\172412DF1F8338E4AD006E9F9788ED2A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\173F0B14BCB5F1B2B2258AFA66FA1F6A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\17BCA321685944580A77D03BECECF588.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\17CF414FA1DE5CE02A5C9AC66A2D8F5E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\180E25D92AFCF71A996BC7AC24F27DD5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\18194DF78686FCBACD0E6868ED0E0919.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1898EDEA64C511B1CB8EF5483101FB35.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\18B9AA34B315DE18655875C087F7E147.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\18F122357839ADA1419DDE2C541904BE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\192325CD712AED7BF56940AD3BB9A176.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\195AE1B89E0FF6CD40670E98BAB3A608.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\198029E6BF51E6E158ECF68FF0B36E3A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\19B9819A1C5AE6BC556E1A65834AEC13.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1A62F8CF28E9ED8FBDCEA3D28AC6D3EF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1AA085F45F04FFF42F8B23EE4B1DD6D5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1AEA6E68EBB34016ED94F24ABB9308E5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1B15F9EA2C8E8A55CC1CBE63FB6B4840.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1B1859A081E5E0E923DE7CA17A3AD0E6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1B243182F610F39F48F63ED2AAF2E4C6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1BF02F5F261B4F6E08912C82760B1564.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1C57A0A063E5D1FAE814B23DFF99DA42.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1C6A987B4B0CF81C64F418964D02E590.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1D17F2812D61D6A27510A5356CBCB2C6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1D2F2472E8915C165DD3667793DD6216.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1D39564B78F00E3F6ED4B4A5662781B2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1D3D7B63AE783F3DBBD4FD9F43301BD1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1D770486C382CDC6F1CD832E1D040FEF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1D8E83D3077F05426D7F5E7C92A52BC2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1DD21D310EE87FB8B3301E43E53F9548.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1E3959634C12CA1C92AEBB0AB0A0CD47.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1E50D6323FD92D3DDCD8B52937074C9C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1ED415C5FAB66F75A8BD9D906ED1FD79.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1F539B7D89D5675D5FBC71A5A1E7C62D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1F5D7EA255DEC718E6C93AFC61039C12.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\1FD16EA55AB471DAD65A8AE31A92BFE1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\20916DA71EC75FCC409872C3207D9C60.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\20EF0B41F86B67FBB71739AA19D6F941.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\210892B3C5033337B5C4FCD68AA35128.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2131A60D40501A974386B9E42E4FC201.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2174D8A485DAE80D1D90B7E5430F164F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2215A345459824E0504DB85AEBB502CE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\22C5E271CACABCBB6D1BF416CB483DB1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\232692AF542DAC9C19624048D7BCE0F9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\23FFA2BEE2CFCB552EEC22762785E6B4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\25CCB9BAD9B50F42124D935083535916.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\25CE4D0A477A7A536B1F5C9965A6C9E4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\25E9A5A2000F7483536AEC7F5BBAD557.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2794DD6CC13BD11ED558AA64C449E6D7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\28DFEEAE5E755E081510079AEA4BA2DB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\29B55D1D5A0BB6BBFD2F6F1D35B3A1BB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2A2AB14E79261C4C2272F4B50901244C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2A8F8C0C68BF867A9E2A7AB38260A4F9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2B416E2919A9D497584044544D3C8433.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2BF259128A811B9C7417AEAD9F596A8E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2C688638F731D0D535DBB9DA2F979753.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2C6A80FDED75E46CA733976E382559CC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2C7CF4E1EA79BFA00DDAAADCB67FCA96.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2D1A849208186237BBED16B3B5D7238E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2DB099F474FFAB578AD726E4F2905FED.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2DFDBD25A9B159E6B632A69ADD81F446.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2E4D19AFECF3B4188F10CD16C8BB92E1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2E60A4684212330C61E1E8704A619754.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2EC8433E19B30A13955120CB32A18CFC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2F0CC20947142CB05C49044919898802.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2F58A8772B1579A81054587DFC0A68CE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\2FA567F6FE2F89694B594B3FAC75D6DF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\30711D4696101AA94690C8C51432F5E2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\30A5229E4F736548D2D9FA13F92C9A82.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\30C22E5728F64CE0E1605A4A77934948.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\30C3808B55CD6C563447B44FC4E9BAD8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\30DFAF0BD5AD387D985719F41E186AD5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\31998CC82EC1ED985097054B275161ED.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\32057A09A1167F6F66F16DA67DF1C918.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3209C3555EE020AE8FA1C869C6A591D9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\320EDC28FFEC3C708AB2DDE6C70FD624.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3281CFB9A42D9486C40C0A4D010D65E6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\329A6D1E4413466F2111A8B0F5C0A51B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\33295A3A1D28CAE3DFB6C5167CCAAE6F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\33A13765948753719F44CA6F7E586909.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\33B9B81C996ACC2B2000070519028F72.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\344FC63DB23C44805CA5C08EAC26522F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\347C4407B808EB65CAFD16126D73D922.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\348C74BBB0C8791244D9BA708604211E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\361C55667115751869AC74207D28DCE7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\36A47C4202A2694FFD79C2BABBD02788.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\36AC724DE559C5D39EB46462A440D4E5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3704297DA195A3B2DADC6D89B6226662.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\371088BC97F0585065A1A08ED83172D6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3778D40681E80056E0C63E6CB18E9E37.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\37846654B2AF369ED3D0A3637E941D9B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\379E5EC415D0E0A49EFDD4B3564BE048.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\37D4F7E4435BDF811F1EC2CBA1EF4A10.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3855849167EAA03A99F4C8450E15A6ED.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\38841DF145EDAB1901F40F6B9A6AF4AA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\38F922911FA0CAE637E5D1EB1013D0F1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\395955902B64122A6EF58A130F284979.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\39C2F82384C755EF218F0F19FE619F80.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3A2F8881A3B96DF2374FCEFB35545D6B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3A65AC537877D583303AEEF0342B5D51.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3A75BC18F00746E3EB756A5A8AB71D56.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3AF58951EB00AD264E4FCF4BA804D893.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3B443485D5F96CA9554D404AA52A1633.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3B60B0417CAF81D69389063C334577F1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3BB167BC6A619E5D11B40C8B9F699327.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3BBB431B659936EB58D4574BC05768CD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3C03DD39D967893238742C503189BA92.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3C11F3A2BFB9588C467B72E02345362F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3C90AAC6E581F57E99B164C33906BD30.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3CA3E3E8C27409E2288B236F5F414F56.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3D486D2EBFD5C380959985A548DC1308.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3D7D7734943CA5F273BDA05F3E1FA20C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3D93BA5591BD981C5D5D6E2BEFACAA50.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3DA405CE6ACE7B7A8320D68D317B9729.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3EB36FAFDAE870DF05542C0B4AAAD7EF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3EE2F37B4639F4307BAF0C707B092F7C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3F78FC5E2CC6CFD8720C796D34A544F7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\3FFDD473F026FB198DA9FA65EE71383C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4001CC0C4B56CFDE0493013FC1D9DD0F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\407E61D88570FDFD5EC8891DBF9A3EBC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\40E224B18F4493C1B8E43DBC496D8E68.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4136DDD03841D93F3D820441F60BE055.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\413CED83449192A10E66EAD24743140E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\42CB2CBBDCBB0DB751E51FF6B279C524.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\430091E25BA6C7FE2FE5DC31776BEACC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\434B7316BB2FAD82DC3E5784AC46B4A0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\43535D7A73D735DEFF9DB83057553D39.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\435A088CDF6FE7426084E4B35C1E81C7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\435FA4D2CAB38A1853F91A3BE8F89D4E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4371EC94BF996AF79B062599D10C927E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\43AC153E4DED1737C66AEC0C7EAD9430.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\43EDE2715871F08D0BEFB4C9DE69E247.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\441A12A68AB1A20902A131356BA4CF30.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\44B487D5879BCD6C593C9066936D12AD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\44C46B87678291B7CFBF7D8A6452D98D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\45277ADB2DA919AFFF18833506353174.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4552656C2901FB1533D6679D49B69929.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4561B54041D5F414CB02373F78461708.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\46F812454290EE1E870544BFEAC8C7EF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4795058F848A6BA6FE24E0530CE2E2DF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\47C87AFF6DBF51980E7CA3E36C38B86B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4846320185EA62FBD8507FD7A9D87E61.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\48959878DDCA03B0FA77D806C7C5D743.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\49C04C47AB946E0864486F81F6E251BC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4B69CC652B5189D5B2136DFDC5369593.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4B95063FF713676A54E7221DF8245C78.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4BD7268ABFF9CFF22DA57949025E2667.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4BE30AA8CC2C4C06B41336B9B3878B1E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4BE9D6CB921FE137B78AE9960CDD98B0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4C3FFB127B4E9B67BFACD89178DE3DA3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4CCFEF2D31696D11C8735BD7C8BE14B9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4D9BCF0F509C90FA86E1ED3A34E158A0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4DAE009EE0BC4B9ECA96E59E303AE1E5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4E20565265CAAFBDB6BA1B1C1ADA9D96.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4E34C76D83E2430D779FE9AA17E87200.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4E8CF66DA5DBCEE8F47DFDDF0B14DEC0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4E941341E008BE47EC9639A14271EBF0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4EA32ABEBFE9B0697C450693940F1673.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4EB0E9424AFEF8E5D68D78C36620E253.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4EF05404F86FAFD7EDAB80262970585E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4F4AD4093274B7A7FF28CDBD5AB3032C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\4F7C501B863AFCFCE3AE018AC07191F9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\50B277BD2B3C116DBC38CC2D1EB7D427.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\50B5B38557DC642A4BC7282A0C8C4AA2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\50E7AE0A90085737B8F04CDF9460DBEA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\50FC9EDA1918FBC981D89D0390125308.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\51588E4AC5E59453F329EBF5A215ACEC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\517ED769F6478117021531216F609C27.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\51B9369C31C913E211D29AA4D91D4747.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5232DBC5D3EE8EBCEF6CCB4213399B9A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5241D310A7F9B793E5E9EC39E65B7B44.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\52DF56A47A08AD380228C64827D24548.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\531218B396F02B35771F8AD1965A574A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5312CF8C0E1EE738404F2A6E526EB4D0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\536E5C7121076D413E48A32D54E26EA3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\53C2FC20B111DA763C20CFDAF7624A26.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\53C824D10974E3D64CB1537B2770F4AD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\553C27B9785BAD9A0C6E81613DD3FCB4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\554B4465433438F4FF7B8D7AB981B555.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\555E8EEF9A21E3F26C263316A778E15F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\55B1D144C8C3666C687E454A80906ECE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\563EAFFF3BF92CE3F60EAEE4EB18BBB3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\568257F0F7CB54EB479EA5E39A4ACD57.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5731B1CD62369AA3EF2B861A7BACB2C5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\57985F4723464E47CF133A601D28906D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\58766C70A633CC3A5AC9393E175CA63A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\59481CB78111FB31D37EDAC9647FAFD8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5960F40D2AAABA9E743AFA7294468C25.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\59A5343CF85A83AE1E7B5EAFC71ABD66.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\59C780751B7740A822CCE33528AC1E14.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5A7BC66EEC954487F6D9911DEAF052BE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5B18367075FE563AF4A12EA837278D84.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5B4B75183FE97E2D052EE74E519015F4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5BE557A291C3EEB7FE628D8099DD0CD3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5C704EA3E7D7B64E50D00711FC13CD34.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5C81F6E368BC71D1D45E2D9206EA3FD0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5C8CE9E608C8192171A5B93767FCC960.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5CFEE986112963509926EC8912E14D25.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5D75A4D5A6D14E6061698FB7BED0446A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5DFFB5C73CF04EE22E19BB74127846D8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5E69759D567F673B36A59095A347BF07.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5EEE7ED3AD74F7D10B2058BB7C19B751.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5F037A89915D44B8819F9FCFDE0B489E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5F08E2D70EBF81C77FA4C99A0901A6C8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\5FC405F33502FCF8B5292EFDDD9AE4FA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\601C41633EC4EEE1FFE41D65491BABD5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\60B3B69ABC4366405469AA15F5B33006.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\60C90B334F5FD0AD576CC5FFCECDFA9C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\617D2BAEB248E81618E2D9342B7323AD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6199F396C445A25AF1DE1CEFFF072560.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\61D0174ACBF8E43615E6DF8019C0583E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\627EE3812DC7A5BF704C057D238F75AA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\62FE034F36B9ACAF125049C4EB64D6A7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6340973172727B5EBAF0A64E92C26B73.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6364E8D3F688917ECAE1050954B63674.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\63B2501D71A2DE162EA12C3CACF8C488.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\644B35DCD280DC69AED674005133C98E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\64B4796A957F50D8E37415358DC4011F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\64BE228C7C03C2D993371E5195306859.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\652B32EA4449A9E8AF422E70ACDF46E4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\653734ED42B7A9B62F119AAB8C9521D8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\657F8341C743B485575944BF32E0125B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\65DE946825EFC13018FEB489315181A4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\662DD1E431BC9D4EB784D7D662BF5114.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\66501D267ABECB2CF3315642D1881501.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\66B28EEE188E29399051A60BAF92D333.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6717E3CAA50A3943B61329778C1DD781.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\671DBBDEA9073F2E4CCCFFF6957044E0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\674888C18C2BA74E9DE8F74501330DC0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6780F8CDE9A603E0A830C9603F2F4D0B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6808D4839451264DD18BB2454D45479E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\682277A939A770BB800CFE4F205D7891.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6874681F627A133631133FDFA2B4FB8D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\687CF9D31E514545A07747EE9CC567AB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\68882E3FA69BD52620343D172BE84815.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\693BB2D22B37188C506A30563317E1D8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6984662FE0A2CC634E49E525D17376AA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6BCCCB82E5792A665667D7E41CC45168.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6BFD34C0EBE9B3A34F525B51261858DF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6CBA7FE164696851E3674A4FC046F926.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6CC07C0289722A5549B9C30F76C249FF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6CC685AEFC129C8DD86F9036F17E943C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6CD4AC2A2B648ABFE8F2F90A5D07829F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6CDB91CE30082B98FE1BEE23E422804C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6CE4D05BA5B97F5FAAA40312E14F0E81.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6D15B1C3AE92D91DCD86360CCC4F53B4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6DADEFFF2FCEDD93F8CEF59036FEF4B9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6E5FACACD2BA0A27C7AE761291F7BED1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6F2F026E4006B8443E4D6AD8DC43B8EF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\6F606DA76B5A34FEC3A95B874DC14C2F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\70121DE772621FEB6480A1C9A3475D5A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\70138AC07076B005E1CFA39BC5BD9175.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\71E680EC580A0039A775A378ECD836FF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7282BB1A61AFF7E0656732EE80CEB6FD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\732BD24D0DF3B5E7191B301E55CDD6D6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\738F657B98502C3F07A67FDC669EB8AB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\739CB6904442C4B4092104AACB73DBB0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\73C8F1FE9282D72F1684DA13FF1346AA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7402D0FB5599777D401744FC6DD201D7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\740FBFCE4E4515C86E8C7E9D18A58DF4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\742B2F1B414C6E566B6BDF87D12D8AA4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7450D0DEE62770FF1E5C905B1BAFD42E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\74AF2F8E62D0745F958B573494C439C8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\74E621F5E9C4849D83DAC55AC565A76B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\757421178679BC54A733A7C4F3DAA07B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\75B8AD308277AE2AEFCDEA0B6A7C3C0C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\75F3B2B3A615155BFB2E7C19531A197A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\76118EA7CDB4BF4005AD84DDF6CE2E66.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\76367CD152E34AC3DD8007741C968AF4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\76A3CA62703735BDC186B9056247C8F7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7716BDB243C38A4A24E728B3817AE0F1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\77E1FE7C589B0FE237874F7EE517A0C1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\785C9F9CED5D122AD92D6BC91312F7FC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7891546B010C902B9C8DE33F55F71498.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\78C249F8A099AEA6A25F33F09F50FB47.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7950D68C8C6F669B94D3E488F0B6BEAB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\79EF8F616077A833BE2747809180BFA5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\79FE6B25E5B132F33880B7F44A66B758.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7C6FCEE9F64D2CC890D867AB97DEE424.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7C7E3220AE92EC87E0436ADE3F5D9931.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7D1DA389789509D61D1AB66097581992.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7D60FA9CA39C59A4B7C96DEFCF0B1B01.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7D8C933AA5FE34FA3316DA4B6E09E654.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7DD87359B51EDB79AC235F97E726EF5A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7E12C6950CA7714D731D5313649CA457.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7E19C857E35FA8D70E57B0F1CB21E5C7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7E856BB33FFDA1141B90AC29735FB9FA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7EAB83B6B5BC37690D2D1B3E22DF7D9E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7F3DC6EFFFDCCEBC37B17C2FDC124638.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7FAB1F3A2B36D6EA27A3DB4EC39C7BD0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\7FAC187A43CA71A854CA4653D8E075B5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\80064700E82C89F9D3E945021BA8C32C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\80571CB6E9439E1C98BA9AC3FA28D3A9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8096010E847A7DE3A3F69A61002DD563.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8151A5CF9B90099D16EDB3EADE4C8CD3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\818B866A009B1338C5AC103B2D8E2372.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\81FCAC08918AF581FDCB45931E356981.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8243D67DDA3785DAD59ACF70CFC203DE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8266DC592F01723A90239C659F1FA6C7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\82DA351296066664DEB012FCCF6D07AA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\82DA415A8C75204A2D758E6DAD53BC36.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\82DFEA0FE38074528C86FA0695FC7E37.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\82FED0C3319594CCF4117CB3B34B5F72.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8349431AF468BA55DBFB84FC50CC17C5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\83E1D5D490B9335941305F44058A6755.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\843980BE43ABA52AC77C57DF068D59B1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\846AC8E6E788D5BDCFBB697A233A8993.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\84BA101DF0936E1318EE1EB10539C9CD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\84EBC179129822B0E00C47B7528F1FDC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\84FD82C473BCBDEA6CFCD53DF80D6022.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8588C815441547988C5E4B9CC6CF7351.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\85917F125E29280A85EDFCDC3B0C8170.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\868B5F1DDD5C341C50C0D359CD22F37B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\869B30EA34E0F5E56CCBB130AAC2BFA1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\86CAC2AF84F4546D81A07C72C8591F6A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\86F4330E57637679ACB9F17E5F9481D1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\86F83A7235F3DC2A6FCDEC052E1E1C74.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\87218B3AEA759A53DCCA78D6B9BBC66F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\875B0EAE58DBE30E13A8DB610457D0AD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\87C0585DEAE72716889B524A66D1B5A3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\886EC825992F9DCB7AF34306DA80E12D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\88C20208CDD4638C0381F2B7EC657564.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8935BD8F59955F30D52E141E311891AB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8999FA8F96032A452671DE654F9BAD9C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\89FA1168564BA2D42E7C412972B44BB5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8BA44FC08995F15033A9F5D56C8BFC72.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8BC8F7B477D3C6C3184AD0372AEE53F6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8BDE235F11AF9276AB26638F45341094.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8BF0E140F8F40D230143B569A1BAE507.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8C11323D7C773C8A79C1C61EB62FE331.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8CB4C42331F0F4BBCC8E1580131EDCE2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8CBA2BE847D0B28A440C5F24567B0891.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8DB46DD597956632ECDB18D7B2BDF70E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8DB9DE86229327C5777721E4A01FB6B4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8E733CB38D1CDCF7377912244F95A3ED.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8E84BA6D260667ADAAD89BFECDD627CB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8ECBCCCC7B4A9C11EC33A03B6E25EA5B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8EE122F840F244E3AE065AF9ADB16CCD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8F07ADF9734C090207F52CC2C29F17AF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8F1ECB08E7908F5D543B0D9386C0EE1B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8FAA7CD5955A0D5862A90FAA2B0A56F4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\8FCABF54BDCC2D55C8203E3B81BAC5FF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\901B1F181D1D82C168094975DEFB52F3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\902F9B116F0B37B699E9A1D4BB1E2784.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\90B516E096C71C814FF03EE3F4B20042.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\92EFA8432E609D6F315DD0A3CB41E1E8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\930C5E176BA9A3D78B730BC00CDDF64E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\945C37C794BCB294DBA8E445FF2C9DB6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9476FC534A628F39C9E25CA2F2B7B45E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\94D3468248838C60F808E50FC66A40D0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\953349B5ECB359DD058D07088EA31408.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\95C6129A16411671ED974764CC24C800.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\95E06CE9FC028717015354732A36A6C1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\960C76B3B2B322906970277571EF6F3C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\966B95F249EDF54D9BE98C23AD9B758A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9694C920807304FD0F9730304298FBFC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\96E2369FBCFC254F09B1EA2AF6E7641A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\97479A7EBC4B4FA9A0F0C7EF9A25471D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9772382673B9BD1FECD8DED342DC39F8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9787DADF23D03D83A63DC8237E63E3EB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\979FEF94607A8F13E19684C45FAA30EE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\97C10655E91CC076C4E294C0127D974B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\97D74F86BDAAADB7B4674A2E199ED992.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9823053171CF53F4038B0801004F87BC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\98A650FE1443CF2F953B6628EE432373.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\99BB0F4219E2381969DCE76BF639AC68.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\99BFB05D8CE546325B5205C32233A3BD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9A977B776702BB9FBB29D1FCCF5F778B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9B0C875B0F6F2F48FB2B5C587F50979C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9B1ABD0CEAE78416529CB8D77CEE7B3A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9B75C712017ED3DA97BEA0D4949BFA74.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9B7AE939DC5E63135058FA28EB025C7C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9B9501A9E26093612D20F39A895DA307.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9C1784EBA4E907589027FCF72DE4C0AD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9C44AA8B16C47059241530441BCD6DD9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9C531048714B59E157A371D1186F796E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9CFE6E9E20D61400007C08E31ED048B4.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9D40E5B032950BC9770539F90AD86275.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9DB628ECA9373F2BA3BCBB592AF60665.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9DEA7F87EAEC9FF8770E55D5A6D8CC91.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9E8B373EB1451CC4B43C871707D12D3D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9ED719089FF4652F4929D88C64B6A1AD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9EF608904C4706610FDA20D08530978E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9F39E54D6756FE5D64BB6FED194D0894.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9FC7214EDE76F8AE24F96A8195852557.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\9FD6F6552A18165F88BF080B1B4DF1DD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A03E3718C1B8425EB481A1EC4850275F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A067787F4F1B728DE125898181C42609.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A0A63361726BDAE3BC29B11F7526AFE6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A0CC7ED8939B47C1ED00EB9F04D19EB0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A0DE0DD786E0E9020C3DFD7004E42694.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A16EB1FCF4FDFE5542D9FE85FCF4F0E0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A269D70CB8C799952AAD6684D1506485.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A2D118894CA6FCC71ACC7DD86296B7A8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A30FD18C5DC0924B89944F8ADE638E27.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A396597A6767121F681B483A4B28ABDB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A39A3B3270FEF11AE8ACF901E67BE359.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A46C038124134B1482949A1DF8ABB385.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A572284932D45BDC47401871C2E01043.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A5B62AD916B641B7A8365E1C7C9C7544.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A5E0C63B1E67223D493A65CA08D7339B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A71089353F923E1FA26964C3E8153739.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A7463B23BFE582993515A0109F19D304.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A7D7570238274B86C73F2E9009BDF74F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A808A31E629557CF0D5F92D5D87BD706.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A837677C21EC0ECFEB9B10CCD2FEB0E5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A88BC3FD19AFFF0EF5E5DD4A97F9B953.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A93568B935C29F9AA2B5DC62D4964431.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A945F8B7098A596A55A7303B78BC8CF1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A97B345CDEAABDA620BFB72AD2A07100.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\A9FBCB4593D76446A380C3F3421BC2A7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AA10CCACD6B301F2187572F1FD684AC5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AA510EA6AD14A8BE52A7D659281F9BF3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AA6235372BA3751E1E4C601E6263D02E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AA69B9C8BBEB509BBB296FEDD7B5ED23.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AB2AD61FC9800DD5C7751E4270E02730.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AB3EC8C66F16D96107223E8469ACA854.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AB545518DC0F250493CCF5B36A459568.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AB947196AECC60D0365253863489134A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\ABA2825A827A4760BD2251B8B781B271.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AD20F64F9DDBB4AB72E615A132B55377.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AD4ADD965106D211E524A76F9B368A14.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AD6E370A764693BABD73A1B75D243F0B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\ADEE1E4F403A605328D0002B7C6CA9C7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AE25594AECD77BF35F6E794162F4DD77.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AE796E3468AD0D0C250FAA45259E22DB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AE8C8067E61E868B002C481CE87EBE05.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AF451AB4377D22C64822DE9E01B1F4E8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AF45D4D704EA10EA55742D1B3C8C6CE2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AF8191ADF52F4156FF8D54FB39842A54.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AF83007CC746311C7050A636C44C02DA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AFC3C909161915255AC43F522C25B858.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AFD8B7D322EE2A1CB2BAF41EC0ADF626.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AFE689599143A3C959EC6ED84C5AE1F9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\AFF15E95C194C0034BFE43E5853DEE63.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B0ABD547895829AB29B56F0812CBB823.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B0C53BEE6C437337AB024CECEE878418.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B10EF7584FC5D16C42403B0CA5BD4DFF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B1FD5C4B728DEE34C2744E42C11D8760.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B250BBA224E8A08823993336C7CB7011.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B25479026E9AAB36CBEBFF51AA0E32B5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B308B28244CE4219C4C6B3315FA83200.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B471CD3F6DA41643CF1F5221FE3E4CF9.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B48FFF8D8BB2AE842F6650E8DE95B954.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B54261EAEEB4A0D8DB966E20CBEF7E52.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B551DA824528E06A014274837CB2A9CB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B5DC6196F95A004EDD1453C12599676B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B6752671A157884075FCC12BEDFB4D69.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B67D454E426E9AEB60ED08DCC946B44B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B6AF1E27DD1C8095A2887A3BECBB76EF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B7133C48CF1507759D1561876C9BA27B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B7840CBF63A47839AD6AD9F714E4D9BB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B789D76E1E0DE4569B56F6FE22E05621.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B7DD4F9016C2EF03ADB325C37FC76454.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B845DD492B0CE12D87559CED569DE6B1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B8870014FB74FB540F3C31EA907A2AE7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\B9B14FBAD84A7125C53EEE7706842C5B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BA42233C2B9592211C49858860047F3F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BA4AF8E4FEBF32A044146607E11B336E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BAE93F9B141EC7983B2E3379E3E9119E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BAE9A5FB11B68C3A726881B291D669F6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BB9039F6B76054E97E7EFE906C52DE12.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BCB9C29787770EE14EFCAC19CF508F66.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BD557D61619F268BDCEA21C2BDB91514.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BD5A24FC505850E33FAACDC4DBFAD85D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BD818313E410FD46A9F63786A32AEE23.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BD880669B37B14C73AF9195DB3A20F28.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BE8B60428F91B5F96E778F2B2C2832A5.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BE8E9D8246C687F5C062F5D47DA1199A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BEB55E5308BFA4DC17987F4D0DF04295.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BEE3F1CC0769E4FD5954E4E649614722.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BF15B53EBA3B9699B34F0453D41230A0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BF7B61BA8D8284B7D0DA637AB41F6C96.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\BF7BF74A57B2030A3BB9979E14C311F1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C03089ABF5861ADFD1F7C923D2F9A153.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C08E9222775EF82A98E5CDD931ACC633.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C09DD3CA03ADBEEE3ABD0ADF668D9848.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C0E71AD79C7DB91864FCD17ECFDE1E10.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C1A0E85153900845F7BA78472B952007.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C1A41FBCA25E3E6CC4CD22064882728F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C1D36889746E38D1BC7C314F51AC80E6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C1FA58EA827D44CFBEE4F63536677F65.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C23F41A19D7EC249FDA170C05916CB8F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C25A6E589BBE06A55DB5B350B80152B1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C274B92CA0AA0BC1531712AF28602FDD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C291730B7DFE0290D98702FB8F8B0F1E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C2CD968A064AA98DCC1CC37592A142C7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C304206E30795E3A6539B5DF349C4270.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C39C0F5D0934BAE90B29A93BEADC257F.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C3C4860D945FD1716E55A2D7AFA8C55D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C3F80855FDF5A3E423EBABF12EB64064.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C40B30214E633F7974F2729FAE1BC67D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C54E46EF4D4F454E2C3ACD269B67494E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C55F973EDD4E17F6A7CA6F8DC77AC2E8.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C599AFA5A6F053BAD70179501868318E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C5A7A3340CB4BCC7A5C994052DAB1A78.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C5E5CB06F45AEA0FE31FFD0A0F94194E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C67614C3E48ABD4BC9E709E2CEB2CE53.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C685465F4F6FC210421DA7E9DD550821.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C687C1EAD6B670CCBAA60909B89F62CB.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C70550846DA118E1E660A10136A7ECA7.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C77491DD5CBE96FF7C3528A0FD4A1410.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C7999B0462D8EAC32E2ED3A9D0017C97.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C7AD207ED7993A4809373AC7E5784F42.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C8306578B5F0D111675384D271B4DAE3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C87E3190BEFC663A6A04D6D857ABE30E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C890A36E670146004F5FA6D96F4C069C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\C98344F72C7B0FA5F30F1BF6877B4E25.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CA1BF3536958E01F710E5995DE6EBE31.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CA519EE48C39BDA3C1538E5565C377FA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CAC0434A24FA3D5F69B4858EAA050C64.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CCFBB6F691A0FA96C5B605CD9D80173B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CD3047E52420EB014D24A73F8DD48F55.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CD658FA16F96D4466BFE68FCE874D955.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CDB59C31DC153347DDACAC08113F8015.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CDC6E4754252FF7D0E8F3C134D265A60.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CDDB319981A500F42CBEC98CD2362007.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CDEEE4A36DD31A28218DBF5A1A529CFD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CE096445AF8F836B82205BD4E80E5A94.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CE7FA5E0DC28E4C7BB0A2AA22DE05392.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CF3C74ACDD4465D23E06A73A9D97DFFD.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\CF4667947FCFC2F62078D3B85CE7EF10.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D003EAB9BB96C7DF227404C6B2582455.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D02971809B01C7E099D44E7A1436F997.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D04911ACFCA47446EFCB01393D3C3F8B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D05C15A4875D58D36F57187E7FE4496A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D05E5243F9713AD9C0F710C5DE549BE2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D06E9123D0C50409B7B9F35A8222CADA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D0E5935486BD6AD49D80F66B81B985DE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D17469C68898749E23D53128870A755C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D1C240EDA191362672EF6FCCB9725F85.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D2412702F385FCB9E6709FB33EB27BDF.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D256B700C202A9389F73688CDED83B7E.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D2EF06310A52FBA8DF0B6BDFC0D3C664.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D2FA07FC4043B26B5CB97692C2AAFF12.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D3B2EC2F727A45FED5DC9D6BD0BC833D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D48232953788C625160D278B29B5D73D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D4D422DBE282F1B12C3A82517EB0D59D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D4F56CCD124A6B24576AF721B0282383.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D566F9B651B60AE7D0B5DEBF57A90E35.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D64EE91A31A31FCBEAA727029795B289.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D69C7ED8E3B896ACD98229CB4DC363B6.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D6E15C5FE0484F1B1192CEC9DD7DCE6A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D6F45CA88F2F5527EC301A7FA3FF5B8C.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D75AD6809E604BB6F018E54A8482C928.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D7B94FF620323D536A3B99CCAA6B78DA.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D7E06DA4457A14F49A9A996F22881130.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D8401E2EC2C3AFBC1A21717167BA8734.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D8A32838B23AD6809B3B7858DA93D26B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D8D1C602836BEF743D38740FCA8D4B8B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D92BDDCE5396A2FDB5F2208AE47E7CE1.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D9D86DD1D8501C39B4325827BB6F2270.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D9DD8F6664E786227542BCC5FCF66D2D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D9E59C2E17E0CE2AC75DA8E34E9214D0.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\D9EB7BAFBC23534E43B93A69CFD89687.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DA27AF57C09E80A784709AD6239EA23B.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DA54B44152345FC1E1817702B2A34D5D.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DA5B702F94B3636728C005C0E5C0A6BE.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DA736886F13A0E2EE2265319FB376753.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DAC96F2A49E2484740F118A3CDF28EA3.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DAEC8125C10A9D1FB182920A9FDE141A.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DB347A2F84FBE8E0965F9BCF8D6FD7E2.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DB54C5562A50379EFADA86F9B3861ABC.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DB81A681168E125300B192421B05FF69.mof

C:\Windows\System32\wbem\mofcomp.exe

mofcomp C:\Windows\System32\wbem\AutoRecover\DB9B568A06C456FE484FF58A5FB76350.mof

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 97.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp

Files

C:\Windows\System32\wbem\Performance\WmiApRpl.h

MD5 1cc4c3b9bb1657be77939f0b565e315d
SHA1 6a7ff123e96da6f7fb0fd9b7d7600bfc3540ee25
SHA256 9eb3cbb0f65809845890159efdab0ff5a910da34252e7d5cff2929cc2fa6ab6a
SHA512 fd461013902cf1f89485efc1cbdd07bc294253a1b60d9950e27cdb12937cbb39e3491ddb5dfdc4386df87fa44ee4ca9b3be01d7048850337ff9d68156eea78ef

C:\Windows\System32\wbem\Performance\WmiApRpl.ini

MD5 a656a56b1fda4aa28383160ba6ebea3b
SHA1 bda09bb6f5f28f5470147113e93d46a02853dfe1
SHA256 639cf8acd1fe25a19b9841c9262b4227fcc33bb6658919d31b10ab849253b318
SHA512 fbc74c738bbebb6265688ebec7a6bce18f5a59e98a5417701e5565d5c6e1f8c350da000005fc7441f8a4622043d4a8fd62efe54308cfa59f4ce9ed027dadebae

C:\Windows\System32\perfc011.dat

MD5 eef14d868d4e0c2354c345abc4902445
SHA1 173c39e29dbe6dfd5044f5f788fa4e7618d68d4d
SHA256 9f32176066529c5699d45728fcad1bccce41d19dded4649b49cb24f7eef9ce7f
SHA512 c926f13a0fc900dd7d740e2d7d33cdd1902ece0bfb44b6e1f5fed6ffd348c3e7d71089fb9792e38799e8df6573bc09e67bbe132cf9c2ae0a7199534dc5d959ee

C:\Windows\System32\perfh007.dat

MD5 82d7f8765db25b313ecf436572dbe840
SHA1 da9ed48d5386a1133f878b3e00988cbf4cdebab8
SHA256 3053aa67e9cb37cd6f9645ef3bec8d43b1863afd852d3860ea73fcd83c7010c3
SHA512 59766b408b548dc020b54c79a426b361112c33c7263c16ca2e69485dadca05fb4c63b6433063e77c6a9e28a43ec6d3c8206ea702a33b79151fa6309d83b316a8

C:\Windows\System32\perfc007.dat

MD5 1bd26a75846ce780d72b93caffac89f6
SHA1 ff89b7c5e8c46c6c2e52383849bbf008bd91d66e
SHA256 55b47d0f965800c179a78314b6489d02788a44fa2ce00f68b2d860440216927a
SHA512 4f5e14637e9e89700f1ee2d0e575d26d4f3d164d859487f1471bf4410dec6d0d7dbf552c6f791c12388be035c6b974610cda8882c6394438e2220b79e4d74e9e

C:\Windows\System32\perfh009.dat

MD5 407f4fed9a4510646f33a2869a184de8
SHA1 e2e622f36b28057bbfbaee754ab6abac2de04778
SHA256 64a9d789cc9e0155153067c4354e1fc8baf3aa319fa870a2047482450811f615
SHA512 1d420ea7ac787df81bbc1534e8fac89227f54fffff70c08c6d2da385762e6c5766448ab4a47aae1c5cbc671776522b6fb6d9c27870b505ae101462bce912867e

C:\Windows\System32\perfh00A.dat

MD5 4e62108a0d4a00aa39624f4f941d2595
SHA1 7fbff1d3ac293c715a303ac37da0ceb12591028b
SHA256 3df3adaa8bd1ec4dd99bf304c7a1b0d513097fbeb8648efad4b127c5522c3263
SHA512 c79a483e4012d8c97f4a2188fdc27ea04bae24993b12487551872f1413a1a0884197dc71d13ba1dfd32c9b2c93089761f6f3ec37f0bb19e209dbf19283462126

C:\Windows\System32\perfc00A.dat

MD5 6d4b430c2abf0ec4ca1909e6e2f097db
SHA1 97c330923a6380fe8ea8e440ce2c568594d3fff7
SHA256 44f8db37f14c399ea27550fa89787add9bfd916ffb0056c37f5908b2bac7723e
SHA512 cf28046fb6ab040d0527d7c89870983c02a110e9fe0ecf276395f080a3bd5745b920a79b3ce3bb820d7a5a878c0d13c37f67f4b5097245c5b93ca1111c1e830b

C:\Windows\System32\perfh00C.dat

MD5 b87c7ea0e738fc61eb32a94fbd6c6775
SHA1 0e730aa70900f623205b93cb1d6e11be4c0d51b5
SHA256 6cd8b09f644b22c39e02af26b57580baa0fbed01b682d158b29c676d17dac5c0
SHA512 4bad64af992b17a5700cf25ccfa299b2db5be846b8bc28233fa6987964994a34694eb53329ede8d04092298e4b16f06563e459692c210111e0420ee34468f23d

C:\Windows\System32\perfh010.dat

MD5 77a299c7d27f4e4372cd6c1de0781586
SHA1 bb6bf16619da6d0acc30797cd10978bde64892fd
SHA256 6699946552b9d5ebe64d6854228984a773e413a345816a5597b7d7035d4c09bf
SHA512 21fa8fd59e56018a3d888aed054e4117b246a5ea4568c2df93334d7565d50a512b5fc2c66c09572f7d1363e5b65ddb34d0c072267be78b15681076d2380cf98b

C:\Windows\System32\perfc010.dat

MD5 c0a264734479700068f6e00ef4fd4aa7
SHA1 4e1a8c6a53ea9b54eb76f12d99b1327137a47ebd
SHA256 71c5a18d082651484ae96e93f127bac9ac217513976b7e98eeb2b879d643b735
SHA512 85ff44333fc4d47b02cdbc8c665c0bace22a19961e40419227976333ec1384ef8779232d241a9e3b54d988117b84c436f695f0be80dd109ede60fed919ee5fca

C:\Windows\System32\perfc00C.dat

MD5 6adbb878124fcd6561655718f12bff5f
SHA1 1711619dda04178fb47eea6658da6ad52f6cf660
SHA256 0b16ac631d596f85f0062dbe5da238c0745bd4c033207cba2508465c7c7983cf
SHA512 88ec8b3c4670970900ef8fdaf0865e24a5bbc9c0ca375eb6ce12e8d8a3ec08c8a45dfc8ae3c7f4ff1974d5e4b53e0905c5dffadb852e730eb8097a22cd750006

C:\Windows\System32\perfh011.dat

MD5 906500b906ff5714abfb310609a6207e
SHA1 e085597f06df2b986f482f37d6077247d76c0cba
SHA256 82df03abd566227a4ec99ceae023f79d5886e93b425ecc4a54f53452593f60f1
SHA512 54c5b7cc290aeb34c93c7c1301d90aac2a1190d6e92893b86264682d91930df9e91c644a00c566841031efc3a0c71322106b8c1ce679e026930094c778e77b96

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-20 09:26

Reported

2024-06-20 09:29

Platform

win10v2004-20240508-en

Max time kernel

58s

Max time network

56s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe"

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Set value (data) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion = 35004f00660048005300200020002d002000630000000000 C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier = "9eb34f9e-785ef437-e" C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier = "57e04b48-c8003c1e-5" C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\ipconfig.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4640 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe C:\Windows\system32\cmd.exe
PID 4640 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe C:\Windows\system32\cmd.exe
PID 1676 wrote to memory of 1652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1676 wrote to memory of 1652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4640 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe C:\Windows\system32\cmd.exe
PID 4640 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe C:\Windows\system32\cmd.exe
PID 4100 wrote to memory of 844 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4100 wrote to memory of 844 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4640 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe C:\Windows\system32\cmd.exe
PID 4640 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe C:\Windows\system32\cmd.exe
PID 1040 wrote to memory of 1604 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1040 wrote to memory of 1604 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4640 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe C:\Windows\system32\cmd.exe
PID 4640 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe C:\Windows\system32\cmd.exe
PID 4848 wrote to memory of 4824 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4824 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4640 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe C:\Windows\system32\cmd.exe
PID 4640 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe C:\Windows\system32\cmd.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 3988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 3988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe

"C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /f /im EpicGamesLauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /f /im FortniteClient-Win64-Shipping.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im Battle.net.exe >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /f /im Battle.net.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c start https://applecheats.cc

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://applecheats.cc/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb821a46f8,0x7ffb821a4708,0x7ffb821a4718

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,3271009292941822049,9682969009267047869,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1916 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,3271009292941822049,9682969009267047869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,3271009292941822049,9682969009267047869,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3271009292941822049,9682969009267047869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3271009292941822049,9682969009267047869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3271009292941822049,9682969009267047869,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3271009292941822049,9682969009267047869,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3271009292941822049,9682969009267047869,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3271009292941822049,9682969009267047869,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3271009292941822049,9682969009267047869,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3271009292941822049,9682969009267047869,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,3271009292941822049,9682969009267047869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,3271009292941822049,9682969009267047869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c NETSH WINSOCK RESET >nul 2>&1

C:\Windows\system32\netsh.exe

NETSH WINSOCK RESET

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c NETSH INT IP RESET >nul 2>&1

C:\Windows\system32\netsh.exe

NETSH INT IP RESET

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c netsh advfirewall reset >nul 2>&1

C:\Windows\system32\netsh.exe

netsh advfirewall reset

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV4 RESET >nul 2>&1

C:\Windows\system32\netsh.exe

NETSH INTERFACE IPV4 RESET

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV6 RESET >nul 2>&1

C:\Windows\system32\netsh.exe

NETSH INTERFACE IPV6 RESET

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c NETSH INTERFACE TCP RESET >nul 2>&1

C:\Windows\system32\netsh.exe

NETSH INTERFACE TCP RESET

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c NETSH INT RESET ALL >nul 2>&1

C:\Windows\system32\netsh.exe

NETSH INT RESET ALL

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1

C:\Windows\system32\ipconfig.exe

IPCONFIG /RELEASE

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1

C:\Windows\system32\ipconfig.exe

IPCONFIG /RELEASE

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c IPCONFIG /FLUSHDNS >nul 2>&1

C:\Windows\system32\ipconfig.exe

IPCONFIG /FLUSHDNS

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c NBTSTAT -R >nul 2>&1

C:\Windows\system32\nbtstat.exe

NBTSTAT -R

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c NBTSTAT -RR >nul 2>&1

C:\Windows\system32\nbtstat.exe

NBTSTAT -RR

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c arp -a >nul 2>&1

C:\Windows\system32\ARP.EXE

arp -a

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c arp -d >nul 2>&1

C:\Windows\system32\ARP.EXE

arp -d

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE >nul 2>&1

C:\Windows\System32\Wbem\WMIC.exe

WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 applecheats.cc udp
N/A 224.0.0.251:5353 udp

Files

memory/4640-0-0x00007FF6D0660000-0x00007FF6D1002000-memory.dmp

memory/4640-1-0x00007FFBA07F0000-0x00007FFBA07F2000-memory.dmp

memory/4640-3-0x00007FF6D0660000-0x00007FF6D1002000-memory.dmp

memory/4640-4-0x00007FF6D0660000-0x00007FF6D1002000-memory.dmp

memory/4640-2-0x00007FF6D0660000-0x00007FF6D1002000-memory.dmp

memory/4640-5-0x00007FF6D0660000-0x00007FF6D1002000-memory.dmp

memory/4640-6-0x00007FF6D0660000-0x00007FF6D1002000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

\??\pipe\LOCAL\crashpad_4824_ZNNTISFGCFKFRACA

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

memory/4640-34-0x00007FF6D0660000-0x00007FF6D1002000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d0d2d7eeb5c915ab14dd6101ffc55e3d
SHA1 9467a45c11fb2052d7a4404cc33598c082b8efd9
SHA256 6d7849f8bcca8bd7389d8f5f221f45c9c711c63a936a95d2e1d64ac409706c2d
SHA512 b27bd4f31008f136010a0b7cb9e14b86a71fe9dc8847c6cfb01f6cfe9bee0dd979bc7dc614214c2ac47f8eb9d2c8de587753e7f7c1e9a30da055a7019caa821d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 278954cfd356c523346625259046e33f
SHA1 dc01d0775dbc7c74913b73cb3ea294769bf4d33e
SHA256 c4f7f40cbcf8e4e6891513db74a32005171363e1e5d733aba477e5c4fbdd71b9
SHA512 33ed78145b497912d04319701345f93d0dd1e0d35aaa31dafbc4afe2c4cf759e3f95d2dd4322107269aba5aa7cac64b995ce6f8cc9c119204ba8a9134f1bef24

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 47e4b452eec091c254295aa26c0db132
SHA1 e9e517875ed7458e908bd97f76c9eba9fef16e4c
SHA256 44b6e10de7030a175196908b6e621fec369ea232a37b4a15197a01896cf8344d
SHA512 24a94dc7a5603d806eff4c1b722d2f96ee945f6086bf6d66af176109f6ac2e7df80c5e90235c8ee0121552e41d51c572742798f59136cb9d751a0a48bd66c44a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 18960dc120c3ad47dd5bb504d9aec9f2
SHA1 4333cb063e317f05f9c931ef284447b9e9ae5f2a
SHA256 6270889792dddcd132b033473b41d650cdf9aa1d8076719898c0f1fb0ef2e969
SHA512 7d1a5814a26aad3fba5c120e0eddf7f81a1ed9480a83aec1705159d69f061aff963a2fea90390f3e86ccb7d3eaca8b89274f4633261a34ac0fcfe4d00a462d16

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58