Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10FN-TOOLZ-m...AN.bat
windows10-2004-x64
10Tournament...ew.exe
windows10-2004-x64
6Tournament...al.dll
windows10-2004-x64
1Tournament...UI.dll
windows10-2004-x64
1Tournament...cl.exe
windows10-2004-x64
1Tournament...uz.exe
windows10-2004-x64
9Tournament...dc.exe
windows10-2004-x64
1Tournament...ft.exe
windows10-2004-x64
1Tournament...64.exe
windows10-2004-x64
1Tournament...32.exe
windows10-2004-x64
1Tournament...64.exe
windows10-2004-x64
4Tournament...fg.exe
windows10-2004-x64
3Tournament...sg.exe
windows10-2004-x64
3Tournament...sr.exe
windows10-2004-x64
10Tournament...wg.exe
windows10-2004-x64
1Tournament...sm.dll
windows10-2004-x64
1Tournament...xy.dll
windows10-2004-x64
7Tournament...ry.dll
windows10-2004-x64
1Tournament...ll.dll
windows10-2004-x64
1Tournament...pi.dll
windows10-2004-x64
1Tournament...32.dll
windows10-2004-x64
1Tournament...da.dll
windows10-2004-x64
1Tournament...ve.dll
windows10-2004-x64
1Tournament...70.dll
windows10-2004-x64
1Tournament...rl.exe
windows10-2004-x64
3Tournament...64.exe
windows10-2004-x64
3Tournament...cs.exe
windows10-2004-x64
8Tournament...64.exe
windows10-2004-x64
10Tournament...tm.exe
windows10-2004-x64
3Tournament...mc.exe
windows10-2004-x64
1FN-TOOLZ-m...er.exe
windows10-2004-x64
9FN-TOOLZ-m...er.bat
windows10-2004-x64
1Analysis
-
max time kernel
170s -
max time network
299s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
26/06/2024, 20:50
Behavioral task
behavioral1
Sample
FN-TOOLZ-main/FNCLEAN.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
Tournament_Fixer/AdditionalRuntimes/DevManView.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
Tournament_Fixer/AdditionalRuntimes/MCCSPal.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
Tournament_Fixer/AdditionalRuntimes/MaintenanceUI.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
Tournament_Fixer/AdditionalRuntimes/ccl.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral6
Sample
Tournament_Fixer/AdditionalRuntimes/cpuz.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Tournament_Fixer/AdditionalRuntimes/ddc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
Tournament_Fixer/AdditionalRuntimes/hssft.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
Tournament_Fixer/AdditionalRuntimes/hwbd64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
Tournament_Fixer/AdditionalRuntimes/hwinfo32.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
Tournament_Fixer/AdditionalRuntimes/hwinfo64.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral12
Sample
Tournament_Fixer/AdditionalRuntimes/jfg.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Tournament_Fixer/AdditionalRuntimes/jsg.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral14
Sample
Tournament_Fixer/AdditionalRuntimes/jsr.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
Tournament_Fixer/AdditionalRuntimes/kwg.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral16
Sample
Tournament_Fixer/AdditionalRuntimes/lsm.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Tournament_Fixer/AdditionalRuntimes/lsmproxy.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
Tournament_Fixer/AdditionalRuntimes/lstelemetry.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
Tournament_Fixer/AdditionalRuntimes/luainstall.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
Tournament_Fixer/AdditionalRuntimes/luiapi.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Tournament_Fixer/AdditionalRuntimes/lz32.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral22
Sample
Tournament_Fixer/AdditionalRuntimes/mcicda.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Tournament_Fixer/AdditionalRuntimes/mciwave.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral24
Sample
Tournament_Fixer/AdditionalRuntimes/mfc70.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
Tournament_Fixer/AdditionalRuntimes/nvrl.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral26
Sample
Tournament_Fixer/AdditionalRuntimes/nvrl64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Tournament_Fixer/AdditionalRuntimes/tcs.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral28
Sample
Tournament_Fixer/AdditionalRuntimes/tcs64.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
Tournament_Fixer/AdditionalRuntimes/tm.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral30
Sample
Tournament_Fixer/AdditionalRuntimes/wmc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
FN-TOOLZ-main/applecleaner.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral32
Sample
FN-TOOLZ-main/serial_checker.bat
Resource
win10v2004-20240508-en
General
-
Target
Tournament_Fixer/AdditionalRuntimes/tcs64.exe
-
Size
318KB
-
MD5
4c5204ea4ab8e1e268e10edd772c55e5
-
SHA1
84e1cab848115d385df057f486e4ce8fee1d62ec
-
SHA256
3e7b17fb961f06378c0ca2a5f60c4835bf1322c81e3756d1a4ac4cbd08caeb12
-
SHA512
8b855a25eb75ada71b41ea474261a2d14a8bed0faf8a7f18678aa8acaa65f4ed6ad9f5f8815fe89eaef5a35ba0997fc2b12f6852da9abee247b5482ae50603a5
-
SSDEEP
6144:3BlkZvaF4NTBu48rYpzPYUqJNUe9iQngwYDKJxnRH04gVv/PUtAQcb:3oSWNT4FrCQvJL9ntJxnRH4R8tAvb
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Winmgmt\Parameters\ServiceDll = "%SystemRoot%\\system32\\wbem\\WMIsvc.dll" regsvr32.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\system32\wbem\AutoRecover\B00FB74CA11300E102C8BD294F6829E0.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\15CB6E2BC4C7288B6A26F06F2EA3EBAA.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\55AFD5FC355BAEE0A5E9A1393CC477E5.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\85E0871D8075E919F55DCF2DFB641E6E.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\6B1F2DE3976B69AE13C438DEE2C6EBFF.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\35EB6C02B117E434146AA8FBB46726E5.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\61EE6F125EE84F973323047E63234C4B.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\4A11A3EDADA91AB03265FADEF0200D75.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\C2E802292DC93400E19D1C12F90D0AF6.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\0A9B9F39B61FEC73EA8A27C11BB272DF.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\4A870B469F34065CA18AB1FDF6312BDF.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\7BE912068D7A19BFDF3D3C5BC12E7629.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\C154BBEB58D93C7D77FC22860A1C9C96.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\A9504475746A00F21135DC17FF7DBCD6.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\BB8DB31CD558B86889B6CACCDFE45A90.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\FDAD11DA772B0E5564617898F2A02617.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\8636DC7F9479DACE6778109CB4FB4B01.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\6F096B7D28A95FE5E8A47222B749D137.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\21A91C51247EF25C7B76A7BD92E72AA7.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\18AF8463CB6C0D2BCE6F124B85344B8F.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\707EA99CEA3ACFD4EFCBBF42CC729B41.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\C516870CE658DF2E471B36157EBE5227.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\11FEAE420A4698D76F6D8B09A28F5DAB.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\40CD8A341670967C555998737DB91D5B.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\FE084724C4570F004BB748191F501852.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\0AE46452A0B3D007DD847D7722347162.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\8C758694767A6F90E85D060DE0636B66.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\DEEDFA8A96B3396FC0902AF10A575F0C.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\45D7D3B7EB0F350515C83365C736C679.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\BE81B2C0741907C1FC1C42B6223E59AD.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\E737DE61441445E1FDFCA45EF5E7D987.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\C1BF66EB0451A8CD07AAC77EC68A4043.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\647E7970BD0F5F9E661068CA6CA7F397.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\92A3E2BF6266CF87720E211CA012ECE7.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\453A436331E0AD94D090421533AB4834.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\7FBCB2ADAF817B3D9CAA1BE9E18B2495.mof Process not Found File created C:\Windows\system32\perfc011.dat regsvr32.exe File created C:\Windows\system32\wbem\AutoRecover\F2ADD0A29CFF4D0576A3741D9AE1C8D3.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\5C6D12CB3AB0D3EDC8D28BCBF9FB244C.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\E85AED94F7A581A1A02F7322094DB3D0.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\A2D31C6DFEE120FEFFD73724708A4827.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\AD1621C948A4E41C8ABE8FC09AC11633.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\C9824ADC136E4798F4F76A6D48117DA8.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\AEAA953C34E29428F04D9906CAFE2169.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\46085E5E756C882D3F6F01D32A3F8D24.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\2AA348C4498C38E2242F58B3308E99E0.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\E33980A0BAD9CCABDB2824A369E52141.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\BCA37BEB911082EA5B73C872086A3B8F.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\32EDB8E30FABC609FF04D61A0874F112.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\3EFDA7C55DEFD2F318D8896068CE2363.mof Process not Found File created C:\Windows\system32\wbem\AutoRecover\44508344C91036373A90B667F2C4D1F2.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\C3A0BE17B37ACE48BE78B31580231AE9.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\EDBF963FB003D0670AA9C2219BD091FB.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\4BD8FD21402CA06647542C55D47F6E47.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\4E7FA4A0256D91829AF21928EC5BC6DB.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\4D557966BDAFAAC1514C928A826375F2.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\B6C73E699C04F876FE75CE460B046079.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\D911EF9E5112E7DA316F0A12476F1ACA.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\5442505746A43B11366F9F8BFE38F703.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\28A02B0A6F3BEA0572B8F35350D88657.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\75054C3771DF289038069A9BB1C1FB6E.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\AFDA9D2CA693B44A2C46D80A3E311ACD.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\9635AD802704D06E888CAB79ECF17188.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\EC5052FBA2CBD13E0EB25DC4C89850E4.mof mofcomp.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\inf\WmiApRpl\WmiApRpl.h regsvr32.exe File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h regsvr32.exe File created C:\Windows\inf\WmiApRpl\WmiApRpl.ini regsvr32.exe File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.ini regsvr32.exe -
Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 412 sc.exe 4960 sc.exe 5100 sc.exe 3544 sc.exe 2984 sc.exe 4536 sc.exe -
Kills process with taskkill 13 IoCs
pid Process 4804 taskkill.exe 2376 taskkill.exe 1660 taskkill.exe 5028 taskkill.exe 3556 taskkill.exe 2364 taskkill.exe 3644 taskkill.exe 3240 taskkill.exe 2936 taskkill.exe 1260 taskkill.exe 2888 taskkill.exe 4932 taskkill.exe 3936 taskkill.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A571F412-E3D2-4A32-BF42-1D3B2203FF17}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{890CB943-D715-401B-98B1-CF82DCF36D7C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04963311-C399-408E-AD51-05D01506EED0}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4819C8D-9AB8-4B2F-B8AE-C77DABF553D5}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5791BC26-CE9C-11D1-97BF-0000F81E849C}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5791BC26-CE9C-11D1-97BF-0000F81E849C}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\WBEMComLocator regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{D31B6A3F-9350-40DE-A3FC-A7EDEB9B7C63} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55F7B88D-A254-4B22-B7BB-FCDBBA1AFA32}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD4F53E0-65DC-11D1-AB64-00C04FD9159E}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5791BC26-CE9C-11D1-97BF-0000F81E849C}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7E9D3B9-E62B-4A90-8CC5-A3C5F662DA7B}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1BE41571-91DD-11D1-AEB2-00C04FB68820} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{25411283-46FC-4326-8DF2-FF5D34B2DFEF}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8EC9CB1-B135-4F10-8B1B-C7188BB0D186}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{6E78DAD9-E187-4D6E-BA63-760256D6F405} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCF33DF4-B510-439F-832A-16B6B514F2A7}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D08B586-343A-11D0-AD46-00C04FD8FDFF}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7D35CFA-348B-485E-B524-252725D697CA}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C19BE32-7500-11D1-AD94-00C04FD8FDFF}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1EF94880-01A8-11D2-A90B-00AA00BF3363} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\WbemScripting.SWbemLocator.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{4FA18276-912A-11D1-AD9B-00C04FD8FDFF} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WbemScripting.SWbemSink.1\ = "WBEM Scripting Sink 1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WbemScripting.SWbemObjectPath\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1108BE51-F58A-4CDA-BB99-7A0227D11D5E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC9072AB-C000-49D8-A5AA-00266C8DBB9B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7E9D3B9-E62B-4A90-8CC5-A3C5F662DA7B}\TypeLib\ = "{0438D53A-9A57-423C-9E54-9612C4576257}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0C0B0642-1DEB-43DF-8032-7A9BF5811A74}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Clsid\{D215781D-019E-4FA0-903D-0CDCDE13A4F5} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JobObjectProv.JobObjectProv regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4819C8D-9AB8-4B2F-B8AE-C77DABF553D5} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0C0B0642-1DEB-43DF-8032-7A9BF5811A74}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{C10B4771-4DA0-11D2-A2F5-00C04F86FB7D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WbemScripting.SWbemSink\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2A504CA2-CA90-4731-87BC-6E99CA2019AF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{37196B38-CCCF-11D2-B35C-00105A1F8177}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B100E1A-1385-4D1F-A02E-6E705A76BB6C} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7E9D3B9-E62B-4A90-8CC5-A3C5F662DA7B}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMICntl.WMISnapin\CurVer\ = "WMICntl.WMISnapin.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9AED384E-CE8B-11D1-8B05-00600806D9B6}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31739D04-3471-4CF4-9A7C-57A44AE71956} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92B9503D-19C3-4181-9F42-57FFC1A4BF37}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BEBCE8B-1AF0-4323-8B4D-36994567CAE1}\NotInsertable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\TypeLib\ = "{0438D53A-9A57-423C-9E54-9612C4576257}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC231970-6AFD-4215-A72E-97242BB08680}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMISnapinAbout.1\ = "Allows configuration and control of the Windows Management Instrumentation (WMI) service." regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5C659258-E236-11D2-8899-00104B2AFB46}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\WbemScripting.SWbemSink regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{580ACAF8-FA1C-11D0-AD72-00C04FD8FDFF}\NumMethods regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WbemScripting.SWbemSink\CurVer\ = "WbemScripting.SWbemSink.1" regsvr32.exe -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2888 taskkill.exe Token: SeDebugPrivilege 4932 taskkill.exe Token: SeDebugPrivilege 5028 taskkill.exe Token: SeDebugPrivilege 3556 taskkill.exe Token: SeDebugPrivilege 2936 taskkill.exe Token: SeDebugPrivilege 3936 taskkill.exe Token: SeDebugPrivilege 4804 taskkill.exe Token: SeDebugPrivilege 2364 taskkill.exe Token: SeDebugPrivilege 3644 taskkill.exe Token: SeDebugPrivilege 2376 taskkill.exe Token: SeDebugPrivilege 1660 taskkill.exe Token: SeDebugPrivilege 1260 taskkill.exe Token: SeDebugPrivilege 3240 taskkill.exe Token: SeSecurityPrivilege 2500 mofcomp.exe Token: SeAssignPrimaryTokenPrivilege 1780 svchost.exe Token: SeIncreaseQuotaPrivilege 1780 svchost.exe Token: SeSecurityPrivilege 1780 svchost.exe Token: SeTakeOwnershipPrivilege 1780 svchost.exe Token: SeLoadDriverPrivilege 1780 svchost.exe Token: SeSystemtimePrivilege 1780 svchost.exe Token: SeBackupPrivilege 1780 svchost.exe Token: SeRestorePrivilege 1780 svchost.exe Token: SeShutdownPrivilege 1780 svchost.exe Token: SeSystemEnvironmentPrivilege 1780 svchost.exe Token: SeUndockPrivilege 1780 svchost.exe Token: SeManageVolumePrivilege 1780 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1780 svchost.exe Token: SeIncreaseQuotaPrivilege 1780 svchost.exe Token: SeSecurityPrivilege 1780 svchost.exe Token: SeTakeOwnershipPrivilege 1780 svchost.exe Token: SeLoadDriverPrivilege 1780 svchost.exe Token: SeSystemtimePrivilege 1780 svchost.exe Token: SeBackupPrivilege 1780 svchost.exe Token: SeRestorePrivilege 1780 svchost.exe Token: SeShutdownPrivilege 1780 svchost.exe Token: SeSystemEnvironmentPrivilege 1780 svchost.exe Token: SeUndockPrivilege 1780 svchost.exe Token: SeManageVolumePrivilege 1780 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1780 svchost.exe Token: SeIncreaseQuotaPrivilege 1780 svchost.exe Token: SeSecurityPrivilege 1780 svchost.exe Token: SeTakeOwnershipPrivilege 1780 svchost.exe Token: SeLoadDriverPrivilege 1780 svchost.exe Token: SeSystemtimePrivilege 1780 svchost.exe Token: SeBackupPrivilege 1780 svchost.exe Token: SeRestorePrivilege 1780 svchost.exe Token: SeShutdownPrivilege 1780 svchost.exe Token: SeSystemEnvironmentPrivilege 1780 svchost.exe Token: SeUndockPrivilege 1780 svchost.exe Token: SeManageVolumePrivilege 1780 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1780 svchost.exe Token: SeIncreaseQuotaPrivilege 1780 svchost.exe Token: SeSecurityPrivilege 1780 svchost.exe Token: SeTakeOwnershipPrivilege 1780 svchost.exe Token: SeLoadDriverPrivilege 1780 svchost.exe Token: SeSystemtimePrivilege 1780 svchost.exe Token: SeBackupPrivilege 1780 svchost.exe Token: SeRestorePrivilege 1780 svchost.exe Token: SeShutdownPrivilege 1780 svchost.exe Token: SeSystemEnvironmentPrivilege 1780 svchost.exe Token: SeUndockPrivilege 1780 svchost.exe Token: SeManageVolumePrivilege 1780 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1780 svchost.exe Token: SeIncreaseQuotaPrivilege 1780 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3520 wrote to memory of 4576 3520 tcs64.exe 95 PID 3520 wrote to memory of 4576 3520 tcs64.exe 95 PID 4576 wrote to memory of 4940 4576 cmd.exe 96 PID 4576 wrote to memory of 4940 4576 cmd.exe 96 PID 4576 wrote to memory of 2888 4576 cmd.exe 97 PID 4576 wrote to memory of 2888 4576 cmd.exe 97 PID 4576 wrote to memory of 4932 4576 cmd.exe 99 PID 4576 wrote to memory of 4932 4576 cmd.exe 99 PID 4576 wrote to memory of 5028 4576 cmd.exe 100 PID 4576 wrote to memory of 5028 4576 cmd.exe 100 PID 4576 wrote to memory of 3556 4576 cmd.exe 101 PID 4576 wrote to memory of 3556 4576 cmd.exe 101 PID 4576 wrote to memory of 2936 4576 cmd.exe 102 PID 4576 wrote to memory of 2936 4576 cmd.exe 102 PID 4576 wrote to memory of 3936 4576 cmd.exe 103 PID 4576 wrote to memory of 3936 4576 cmd.exe 103 PID 4576 wrote to memory of 4804 4576 cmd.exe 104 PID 4576 wrote to memory of 4804 4576 cmd.exe 104 PID 4576 wrote to memory of 2364 4576 cmd.exe 105 PID 4576 wrote to memory of 2364 4576 cmd.exe 105 PID 4576 wrote to memory of 3644 4576 cmd.exe 106 PID 4576 wrote to memory of 3644 4576 cmd.exe 106 PID 4576 wrote to memory of 2376 4576 cmd.exe 107 PID 4576 wrote to memory of 2376 4576 cmd.exe 107 PID 4576 wrote to memory of 1660 4576 cmd.exe 108 PID 4576 wrote to memory of 1660 4576 cmd.exe 108 PID 4576 wrote to memory of 1260 4576 cmd.exe 109 PID 4576 wrote to memory of 1260 4576 cmd.exe 109 PID 4576 wrote to memory of 3240 4576 cmd.exe 110 PID 4576 wrote to memory of 3240 4576 cmd.exe 110 PID 4576 wrote to memory of 5100 4576 cmd.exe 111 PID 4576 wrote to memory of 5100 4576 cmd.exe 111 PID 4576 wrote to memory of 3544 4576 cmd.exe 112 PID 4576 wrote to memory of 3544 4576 cmd.exe 112 PID 4576 wrote to memory of 2984 4576 cmd.exe 113 PID 4576 wrote to memory of 2984 4576 cmd.exe 113 PID 4576 wrote to memory of 4536 4576 cmd.exe 114 PID 4576 wrote to memory of 4536 4576 cmd.exe 114 PID 4576 wrote to memory of 412 4576 cmd.exe 115 PID 4576 wrote to memory of 412 4576 cmd.exe 115 PID 4576 wrote to memory of 3264 4576 cmd.exe 116 PID 4576 wrote to memory of 3264 4576 cmd.exe 116 PID 3264 wrote to memory of 5084 3264 net.exe 117 PID 3264 wrote to memory of 5084 3264 net.exe 117 PID 4576 wrote to memory of 3000 4576 cmd.exe 121 PID 4576 wrote to memory of 3000 4576 cmd.exe 121 PID 4576 wrote to memory of 1776 4576 cmd.exe 122 PID 4576 wrote to memory of 1776 4576 cmd.exe 122 PID 4576 wrote to memory of 724 4576 cmd.exe 123 PID 4576 wrote to memory of 724 4576 cmd.exe 123 PID 4576 wrote to memory of 4944 4576 cmd.exe 124 PID 4576 wrote to memory of 4944 4576 cmd.exe 124 PID 4576 wrote to memory of 4480 4576 cmd.exe 125 PID 4576 wrote to memory of 4480 4576 cmd.exe 125 PID 4576 wrote to memory of 968 4576 cmd.exe 126 PID 4576 wrote to memory of 968 4576 cmd.exe 126 PID 4576 wrote to memory of 612 4576 cmd.exe 127 PID 4576 wrote to memory of 612 4576 cmd.exe 127 PID 4576 wrote to memory of 2936 4576 cmd.exe 128 PID 4576 wrote to memory of 2936 4576 cmd.exe 128 PID 4576 wrote to memory of 3208 4576 cmd.exe 129 PID 4576 wrote to memory of 3208 4576 cmd.exe 129 PID 4576 wrote to memory of 2488 4576 cmd.exe 130 PID 4576 wrote to memory of 2488 4576 cmd.exe 130 -
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tournament_Fixer\AdditionalRuntimes\tcs64.exe"C:\Users\Admin\AppData\Local\Temp\Tournament_Fixer\AdditionalRuntimes\tcs64.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\39C8.tmp\39C9.tmp\39CA.bat C:\Users\Admin\AppData\Local\Temp\Tournament_Fixer\AdditionalRuntimes\tcs64.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"3⤵PID:4940
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im epicgameslauncher.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteClient-Win64-Shipping_EAC.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteClient-Win64-Shipping_BE.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteLauncher.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3556
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im OneDrive.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteClient-Win64-Shipping.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3936
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im EpicGamesLauncher.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4804
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im UnrealCEFSubProcess.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im CEFProcess.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3644
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im EasyAntiCheat.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im BEService.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im BEServices.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im BattleEye.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3240
-
-
C:\Windows\system32\sc.exeSc stop EasyAntiCheat3⤵
- Launches sc.exe
PID:5100
-
-
C:\Windows\system32\sc.exeSc stop FortniteClient-Win64-Shipping_EAC3⤵
- Launches sc.exe
PID:3544
-
-
C:\Windows\system32\sc.exeSc stop BattleEye3⤵
- Launches sc.exe
PID:2984
-
-
C:\Windows\system32\sc.exeSc stop FortniteClient-Win64-Shipping_BE3⤵
- Launches sc.exe
PID:4536
-
-
C:\Windows\system32\sc.exesc config winmgmt start= disabled3⤵
- Launches sc.exe
PID:412
-
-
C:\Windows\system32\net.exenet stop winmgmt /y3⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop winmgmt /y4⤵PID:5084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir /b *.dll3⤵PID:3000
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s appbackgroundtask.dll3⤵PID:1776
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s cimwin32.dll3⤵
- Modifies registry class
PID:724
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s DMWmiBridgeProv.dll3⤵PID:4944
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s DMWmiBridgeProv1.dll3⤵PID:4480
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s dnsclientcim.dll3⤵PID:968
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s dnsclientpsprovider.dll3⤵PID:612
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s Dscpspluginwkr.dll3⤵PID:2936
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s dsprov.dll3⤵
- Modifies registry class
PID:3208
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s EmbeddedLockdownWmi.dll3⤵PID:2488
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s esscli.dll3⤵PID:1168
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s EventTracingManagement.dll3⤵PID:2508
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s fastprox.dll3⤵
- Modifies registry class
PID:396
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s ipmiprr.dll3⤵PID:3980
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s ipmiprv.dll3⤵PID:2072
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s KrnlProv.dll3⤵
- Modifies registry class
PID:1540
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s MDMAppProv.dll3⤵PID:540
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s MDMSettingsProv.dll3⤵PID:916
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s Microsoft.AppV.AppVClientWmi.dll3⤵PID:1660
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s Microsoft.Uev.AgentWmi.dll3⤵
- Modifies registry class
PID:4960
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s MMFUtil.dll3⤵PID:4936
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s mofd.dll3⤵
- Modifies registry class
PID:4604
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s mofinstall.dll3⤵PID:688
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s msdtcwmi.dll3⤵PID:1448
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s msiprov.dll3⤵PID:4276
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s NCProv.dll3⤵PID:2560
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s ndisimplatcim.dll3⤵PID:1780
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s NetAdapterCim.dll3⤵PID:636
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s netdacim.dll3⤵PID:860
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s NetEventPacketCapture.dll3⤵PID:4392
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s netnccim.dll3⤵PID:2320
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s NetPeerDistCim.dll3⤵PID:4632
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s netswitchteamcim.dll3⤵PID:1932
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s NetTCPIP.dll3⤵PID:1744
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s netttcim.dll3⤵PID:640
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s nlmcim.dll3⤵PID:3612
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s ntevt.dll3⤵
- Modifies registry class
PID:2592
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s PolicMan.dll3⤵PID:4028
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s PrintManagementProvider.dll3⤵PID:4384
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s qoswmi.dll3⤵PID:744
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s RacWmiProv.dll3⤵PID:1908
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s repdrvfs.dll3⤵PID:1016
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s schedprov.dll3⤵PID:2648
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s ServDeps.dll3⤵PID:4000
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s SMTPCons.dll3⤵PID:980
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s stdprov.dll3⤵PID:1108
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s vdswmi.dll3⤵
- Modifies registry class
PID:2620
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s viewprov.dll3⤵
- Modifies registry class
PID:2960
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s vpnclientpsprovider.dll3⤵PID:2260
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s vsswmi.dll3⤵PID:3000
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s wbemcntl.dll3⤵
- Modifies registry class
PID:1776
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s wbemcons.dll3⤵PID:724
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s wbemcore.dll3⤵
- Modifies registry class
PID:4944
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s wbemdisp.dll3⤵
- Modifies registry class
PID:4480
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s wbemess.dll3⤵
- Modifies registry class
PID:968
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s wbemprox.dll3⤵
- Modifies registry class
PID:612
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s wbemsvc.dll3⤵
- Modifies registry class
PID:2936
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s WdacWmiProv.dll3⤵PID:1648
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s wfascim.dll3⤵PID:5116
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s Win32_EncryptableVolume.dll3⤵PID:3288
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s Win32_Tpm.dll3⤵PID:1168
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s WinMgmtR.dll3⤵PID:388
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s WmiApRes.dll3⤵PID:4952
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s WmiApRpl.dll3⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:2180
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s WMICOOKR.dll3⤵PID:1928
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s WmiDcPrv.dll3⤵PID:5028
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s wmipcima.dll3⤵PID:4944
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s wmipdfs.dll3⤵PID:2676
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s wmipdskq.dll3⤵PID:1492
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s WmiPerfClass.dll3⤵PID:968
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s WmiPerfInst.dll3⤵PID:612
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s WMIPICMP.dll3⤵PID:4480
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s WMIPIPRT.dll3⤵PID:1648
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s WMIPJOBJ.dll3⤵
- Modifies registry class
PID:1880
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s wmiprov.dll3⤵PID:2184
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s WmiPrvSD.dll3⤵
- Modifies registry class
PID:3104
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s WMIPSESS.dll3⤵
- Modifies registry class
PID:388
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s WMIsvc.dll3⤵
- Server Software Component: Terminal Services DLL
- Modifies registry class
PID:3980
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s wmitimep.dll3⤵
- Modifies registry class
PID:1540
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s wmiutils.dll3⤵PID:5104
-
-
C:\Windows\System32\wbem\WmiPrvSE.exewmiprvse /regserver3⤵PID:2920
-
-
C:\Windows\System32\wbem\WinMgmt.exewinmgmt /regserver3⤵PID:2256
-
-
C:\Windows\system32\sc.exesc config winmgmt start= auto3⤵
- Launches sc.exe
PID:4960
-
-
C:\Windows\system32\net.exenet start winmgmt3⤵PID:1572
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start winmgmt4⤵PID:2492
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir /s /b *.mof *.mfl3⤵PID:1212
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\aeinv.mof3⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AgentWmi.mof3⤵PID:5032
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AgentWmiUninstall.mof3⤵PID:3192
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\appbackgroundtask.mof3⤵PID:2248
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\appbackgroundtask_uninstall.mof3⤵PID:4944
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AuditRsop.mof3⤵PID:3412
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\authfwcfg.mof3⤵PID:4240
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\bcd.mof3⤵PID:4916
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\BthMtpEnum.mof3⤵PID:3408
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\cimdmtf.mof3⤵PID:3776
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\cimwin32.mof3⤵PID:1212
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\CIWmi.mof3⤵PID:2388
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\classlog.mof3⤵PID:464
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\cli.mof3⤵PID:1872
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\cliegaliases.mof3⤵PID:2248
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\ddp.mof3⤵PID:4732
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\dimsjob.mof3⤵PID:4328
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\dimsroam.mof3⤵PID:4352
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\DMWmiBridgeProv.mof3⤵PID:3380
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\DMWmiBridgeProv1.mof3⤵PID:1172
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\DMWmiBridgeProv1_Uninstall.mof3⤵PID:1508
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\DMWmiBridgeProv_Uninstall.mof3⤵PID:4532
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\dnsclientcim.mof3⤵PID:1604
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\dnsclientpsprovider.mof3⤵PID:2592
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\dnsclientpsprovider_Uninstall.mof3⤵PID:2632
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\drvinst.mof3⤵PID:2528
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\DscCore.mof3⤵PID:4872
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\DscCoreConfProv.mof3⤵PID:4628
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\dscproxy.mof3⤵PID:612
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\DscTimer.mof3⤵PID:2936
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\dsprov.mof3⤵PID:1868
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\eaimeapi.mof3⤵PID:2364
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\embeddedlockdownwmi.mof3⤵PID:4844
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\embeddedlockdownwmi_Uninstall.mof3⤵PID:3380
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\EventTracingManagement.mof3⤵PID:540
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\fdPHost.mof3⤵PID:1508
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\fdrespub.mof3⤵PID:2288
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\fdSSDP.mof3⤵PID:980
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\fdWNet.mof3⤵PID:4324
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\fdWSD.mof3⤵PID:5032
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\filetrace.mof3⤵PID:4340
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\firewallapi.mof3⤵PID:3492
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\FolderRedirectionWMIProvider.mof3⤵PID:5028
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\FunDisc.mof3⤵PID:2212
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\fwcfg.mof3⤵PID:2248
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\hbaapi.mof3⤵PID:3208
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\hnetcfg.mof3⤵PID:1852
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\IMAPIv2-Base.mof3⤵PID:4352
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\IMAPIv2-FileSystemSupport.mof3⤵PID:1880
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\IMAPIv2-LegacyShim.mof3⤵PID:4876
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\interop.mof3⤵PID:2340
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\IpmiDTrc.mof3⤵PID:540
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\ipmiprv.mof3⤵PID:4536
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\IpmiPTrc.mof3⤵PID:3240
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\ipsecsvc.mof3⤵PID:1936
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\iscsidsc.mof3⤵PID:3192
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\iscsihba.mof3⤵PID:3040
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\iscsiprf.mof3⤵PID:4464
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\iscsirem.mof3⤵PID:4500
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\iscsiwmiv2.mof3⤵PID:4936
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\iscsiwmiv2_uninstall.mof3⤵PID:3776
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\kerberos.mof3⤵PID:3440
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\krnlprov.mof3⤵
- Drops file in System32 directory
PID:4472
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\L2SecHC.mof3⤵PID:3500
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\lltdio.mof3⤵PID:3604
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\lltdsvc.mof3⤵PID:452
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\lsasrv.mof3⤵PID:1296
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\mblctr.mof3⤵PID:4200
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\MDMAppProv.mof3⤵PID:1852
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\MDMAppProv_Uninstall.mof3⤵
- Drops file in System32 directory
PID:5104
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\MDMSettingsProv.mof3⤵PID:412
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\MDMSettingsProv_Uninstall.mof3⤵PID:3776
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\Microsoft-Windows-OfflineFiles.mof3⤵PID:4128
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\Microsoft-Windows-Remote-FileSystem.mof3⤵PID:2592
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\Microsoft.AppV.AppVClientWmi.mof3⤵PID:1936
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\Microsoft.Uev.ManagedAgentWmi.mof3⤵PID:2248
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\Microsoft.Uev.ManagedAgentWmiUninstall.mof3⤵PID:612
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\mispace.mof3⤵
- Drops file in System32 directory
PID:1296
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\mispace_uninstall.mof3⤵PID:4944
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\mmc.mof3⤵PID:556
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\mountmgr.mof3⤵PID:3408
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\mpeval.mof3⤵PID:1788
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\mpsdrv.mof3⤵PID:1900
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\mpssvc.mof3⤵PID:1964
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\MsDtcWmi.mof3⤵PID:4340
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\msfeeds.mof3⤵PID:1488
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\msfeedsbs.mof3⤵PID:3500
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\msi.mof3⤵PID:2488
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\msiscsi.mof3⤵PID:3936
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\MsNetImPlatform.mof3⤵PID:4968
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\mstsc.mof3⤵PID:2960
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\mstscax.mof3⤵PID:3188
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\msv1_0.mof3⤵PID:2508
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\mswmdm.mof3⤵PID:5104
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\ncprov.mof3⤵PID:232
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\ncsi.mof3⤵PID:1868
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\ndistrace.mof3⤵
- Drops file in System32 directory
PID:3736
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\NetAdapterCim.mof3⤵PID:1964
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\NetAdapterCimTrace.mof3⤵PID:4536
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\NetAdapterCimTraceUninstall.mof3⤵PID:1936
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\NetAdapterCim_uninstall.mof3⤵PID:3192
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\netdacim.mof3⤵PID:2488
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\netdacim_uninstall.mof3⤵PID:1728
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\NetEventPacketCapture.mof3⤵PID:4968
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\NetEventPacketCapture_uninstall.mof3⤵PID:1244
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\netnccim.mof3⤵PID:4824
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\netnccim_uninstall.mof3⤵PID:4572
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\NetPeerDistCim.mof3⤵PID:556
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\NetPeerDistCim_uninstall.mof3⤵PID:4016
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\netprofm.mof3⤵PID:2548
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\NetSwitchTeam.mof3⤵PID:3240
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\NetTCPIP.mof3⤵PID:5032
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\NetTCPIP_Uninstall.mof3⤵PID:464
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\netttcim.mof3⤵PID:3500
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\netttcim_uninstall.mof3⤵PID:4660
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\networkitemfactory.mof3⤵PID:4340
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\newdev.mof3⤵PID:612
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\nlasvc.mof3⤵PID:228
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\nlmcim.mof3⤵PID:2516
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\nlmcim_uninstall.mof3⤵PID:400
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\nlsvc.mof3⤵PID:1872
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\npivwmi.mof3⤵PID:3408
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\nshipsec.mof3⤵PID:1788
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\ntevt.mof3⤵PID:4860
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\ntfs.mof3⤵PID:3504
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\OfflineFilesConfigurationWmiProvider.mof3⤵PID:3032
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\OfflineFilesConfigurationWmiProvider_Uninstall.mof3⤵PID:4076
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\OfflineFilesWmiProvider.mof3⤵PID:3604
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\OfflineFilesWmiProvider_Uninstall.mof3⤵PID:4960
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\p2p-mesh.mof3⤵PID:452
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\p2p-pnrp.mof3⤵PID:2288
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\pcsvDevice.mof3⤵PID:5100
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\pcsvDevice_Uninstall.mof3⤵PID:3716
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\PNPXAssoc.mof3⤵PID:872
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\PolicMan.mof3⤵PID:3784
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\polproc.mof3⤵PID:1508
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\polprocl.mof3⤵PID:2112
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\polprou.mof3⤵PID:4016
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\polstore.mof3⤵PID:1900
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\portabledeviceapi.mof3⤵PID:1488
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\portabledeviceclassextension.mof3⤵PID:316
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\portabledeviceconnectapi.mof3⤵PID:3644
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\portabledevicetypes.mof3⤵PID:2592
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\portabledevicewiacompat.mof3⤵PID:3096
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\powermeterprovider.mof3⤵PID:1648
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\PowerPolicyProvider.mof3⤵PID:2488
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\ppcRsopCompSchema.mof3⤵PID:2528
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\ppcRsopUserSchema.mof3⤵PID:1172
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\PrintFilterPipelineSvc.mof3⤵PID:4824
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\PrintManagementProvider.mof3⤵PID:5104
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\profileassociationprovider.mof3⤵PID:1544
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\PS_MMAgent.mof3⤵PID:1868
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\qmgr.mof3⤵PID:1788
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\qoswmi.mof3⤵PID:1400
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\qoswmitrc.mof3⤵
- Drops file in System32 directory
PID:3736
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\qoswmitrc_uninstall.mof3⤵PID:1516
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\qoswmi_uninstall.mof3⤵PID:464
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\RacWmiProv.mof3⤵PID:1536
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\rdpendp.mof3⤵PID:3096
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\rdpinit.mof3⤵PID:4680
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\rdpshell.mof3⤵PID:1728
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\refs.mof3⤵PID:2528
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\refsv1.mof3⤵PID:1172
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\regevent.mof3⤵PID:4112
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\Remove.Microsoft.AppV.AppvClientWmi.mof3⤵PID:2920
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\rsop.mof3⤵
- Drops file in System32 directory
PID:4800
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\rspndr.mof3⤵PID:3452
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\samsrv.mof3⤵PID:3316
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\scersop.mof3⤵PID:4000
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\schannel.mof3⤵PID:2616
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\SchedProv.mof3⤵PID:5080
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\scm.mof3⤵
- Drops file in System32 directory
PID:1360
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\scrcons.mof3⤵PID:4960
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\sdbus.mof3⤵PID:1648
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\secrcw32.mof3⤵
- Drops file in System32 directory
PID:3188
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\SensorsClassExtension.mof3⤵PID:372
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\ServiceModel.mof3⤵
- Drops file in System32 directory
PID:3000
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\ServiceModel35.mof3⤵PID:2212
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\services.mof3⤵PID:1544
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\setupapi.mof3⤵PID:2920
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\SmbWitnessWmiv2Provider.mof3⤵PID:2180
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\smbwmiv2.mof3⤵PID:3452
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\smtpcons.mof3⤵PID:1904
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\sppwmi.mof3⤵PID:3964
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\sr.mof3⤵PID:4488
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\sstpsvc.mof3⤵PID:1536
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\storagewmi.mof3⤵PID:4340
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\storagewmi_passthru.mof3⤵
- Drops file in System32 directory
PID:5100
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\storagewmi_passthru_uninstall.mof3⤵PID:4668
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\storagewmi_uninstall.mof3⤵PID:4200
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\stortrace.mof3⤵PID:3000
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\subscrpt.mof3⤵PID:4592
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\system.mof3⤵PID:2072
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\tcpip.mof3⤵PID:4628
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\tsallow.mof3⤵PID:5072
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\tscfgwmi.mof3⤵PID:1172
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\tsmf.mof3⤵PID:316
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\tspkg.mof3⤵PID:1964
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\umb.mof3⤵PID:3412
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\umbus.mof3⤵PID:1852
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\umpass.mof3⤵PID:916
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\umpnpmgr.mof3⤵PID:452
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\UserProfileConfigurationWmiProvider.mof3⤵PID:1648
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\UserProfileWmiProvider.mof3⤵PID:2492
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\UserStateWMIProvider.mof3⤵PID:5104
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\vds.mof3⤵PID:3784
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\vpnclientpsprovider.mof3⤵PID:1508
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\vpnclientpsprovider_Uninstall.mof3⤵PID:1788
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\vss.mof3⤵PID:4800
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WBEMCons.mof3⤵PID:3452
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wcncsvc.mof3⤵PID:3736
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WdacEtwProv.mof3⤵PID:1516
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WdacWmiProv.mof3⤵PID:4412
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WdacWmiProv_Uninstall.mof3⤵PID:2500
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\Wdf01000.mof3⤵PID:3604
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\Wdf01000Uninstall.mof3⤵PID:4968
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wdigest.mof3⤵PID:2304
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WFAPIGP.mof3⤵PID:1776
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wfascim.mof3⤵PID:4824
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wfascim_uninstall.mof3⤵PID:556
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WFP.MOF3⤵PID:1012
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wfs.mof3⤵PID:1512
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\whqlprov.mof3⤵PID:2920
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\Win32_DeviceGuard.mof3⤵
- Drops file in System32 directory
PID:1744
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\win32_encryptablevolume.mof3⤵PID:2428
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\Win32_EncryptableVolumeUninstall.mof3⤵PID:1572
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\win32_printer.mof3⤵PID:3452
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\Win32_Tpm.mof3⤵PID:4228
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wininit.mof3⤵PID:4076
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\winipsec.mof3⤵PID:3192
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\winlogon.mof3⤵PID:3096
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\Winsat.mof3⤵PID:1852
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WinsatUninstall.mof3⤵PID:3220
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wlan.mof3⤵PID:372
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WLanHC.mof3⤵PID:1384
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wmi.mof3⤵PID:4852
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wmipcima.mof3⤵PID:3740
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wmipdfs.mof3⤵PID:2840
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wmipdskq.mof3⤵PID:3556
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WmiPerfClass.mof3⤵PID:3136
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WmiPerfInst.mof3⤵PID:2428
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wmipicmp.mof3⤵PID:5072
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wmipiprt.mof3⤵PID:2676
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wmipjobj.mof3⤵PID:4328
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wmipsess.mof3⤵PID:4488
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wmitimep.mof3⤵
- Drops file in System32 directory
PID:4680
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WMI_Tracing.mof3⤵PID:452
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wmp.mof3⤵PID:2516
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wmpnetwk.mof3⤵PID:4420
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wpdbusenum.mof3⤵PID:4200
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wpdcomp.mof3⤵PID:4476
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wpdfs.mof3⤵PID:5104
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wpdmtp.mof3⤵PID:4372
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wpdshext.mof3⤵PID:4524
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WPDShServiceObj.mof3⤵PID:1912
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wpdsp.mof3⤵PID:3380
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wpd_ci.mof3⤵PID:1788
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wscenter.mof3⤵PID:4800
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WsmAgent.mof3⤵PID:3440
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WsmAgentUninstall.mof3⤵PID:1572
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WsmAuto.mof3⤵PID:3092
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wsp_fs.mof3⤵
- Drops file in System32 directory
PID:4532
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wsp_fs_uninstall.mof3⤵PID:2560
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wsp_health.mof3⤵PID:4940
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wsp_health_uninstall.mof3⤵PID:1536
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wsp_sr.mof3⤵PID:3696
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\wsp_sr_uninstall.mof3⤵PID:2420
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WUDFx.mof3⤵PID:4420
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\Wudfx02000.mof3⤵PID:3628
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\Wudfx02000Uninstall.mof3⤵
- Drops file in System32 directory
PID:5100
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\WUDFxUninstall.mof3⤵PID:1012
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\xwizards.mof3⤵PID:3784
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\000CA9FCCEA7C766DFE3B6493B9A908F.mof3⤵PID:2840
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\016A4FDC29C2CD1C06090D04CC752B4D.mof3⤵PID:1268
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\01B65BA66800FEA5CE7F4892966D7559.mof3⤵PID:1788
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\01D083B8F092E9FEF6D9C55A64A75334.mof3⤵PID:4000
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\01EA423F27498C64D3F6C297AE2BD8F2.mof3⤵PID:3316
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\020FD1D34279A20EBB3742D63B9E359A.mof3⤵PID:1572
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0232BC928C9666E5DB91EC0848F13E18.mof3⤵PID:4848
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0309255AB46E3D6CAE2056340225DDA9.mof3⤵PID:3192
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0357610A8F431F78C35A3F00FF8E7E13.mof3⤵PID:2632
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\038145628EF306DCD8FD7686C52BD131.mof3⤵PID:228
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\03E20F6C54427A7C0DDEE97EC0898FAB.mof3⤵PID:1852
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\042E30CED0EE9B02641D0960BD5D6854.mof3⤵PID:2488
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0471EE6D56711CCAFEBCF01C57F9159A.mof3⤵PID:64
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\04920A1D7F20A747256FB48CA8A0147B.mof3⤵PID:1384
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\04B1FC5EA475F43F0CF8815E33B5913C.mof3⤵
- Drops file in System32 directory
PID:3628
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\04D5961EC17DF68D8407B772F9C7DF98.mof3⤵PID:5100
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\050F60C5DEC201482BC14E317519A6F6.mof3⤵PID:4372
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\057069C8BCE64220B28DD683690F6879.mof3⤵PID:4524
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0583E7E08D1877A324A2553D19A795EA.mof3⤵PID:1744
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\069B498336DCA76D929AAAF5631ED0A5.mof3⤵PID:3380
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\06A22D2701E90D7DDCF8AAC0522F2449.mof3⤵PID:2544
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\06DAE99BF3D429EE4946D4BF8BFF8C96.mof3⤵PID:4536
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\06DEE93B2013BBE13958B3FA0D45AEB5.mof3⤵PID:4468
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0736061F644ECE849A494F2EDE2008CE.mof3⤵PID:944
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\086D10A6F37ED2F988C9A8EDEF53B707.mof3⤵
- Drops file in System32 directory
PID:4616
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\08BF1AF6E61B8456B1D5B42769C3412C.mof3⤵PID:4328
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\08D51E934D3BA7EB8F60B6E90B6F1511.mof3⤵
- Drops file in System32 directory
PID:1244
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\08F894CB142235B53617974B1893CC74.mof3⤵PID:228
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\09329A919E0B1FEB9E13BE1D4E8C71B0.mof3⤵PID:452
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0955A3255BE8F939592AA33CBFED6637.mof3⤵PID:1932
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\095DDA6145E278EC67897251831FDD47.mof3⤵PID:4968
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\097C63F5D2B8C4182BEB625A8287192D.mof3⤵PID:2532
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\09A251213F70FF824ABB31AACEEAC17F.mof3⤵PID:4824
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0A2DA7EA3492D7ECD2C313A8B7490FC1.mof3⤵PID:1068
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0A49A422B8A92BD87756E892C1BAEC38.mof3⤵PID:3740
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0A76D835FEE42A0F9B07455539850A30.mof3⤵PID:1512
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0A7CF62821E141ADACC0C287DDD01839.mof3⤵PID:2072
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0B21EB6E1A9BA82714E2C9FCB1DD6E8A.mof3⤵PID:2388
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0B7747DAC81B5CDD2893AAE2E4BBE034.mof3⤵
- Drops file in System32 directory
PID:3504
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0BE369FFE21F5817AE0847874550D36B.mof3⤵
- Drops file in System32 directory
PID:1788
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0C0B602529B4AB335EE2B6BDD125ADB2.mof3⤵PID:2616
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0C840E79E220554456F582031714D456.mof3⤵PID:1904
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0CB6D8EA6179D949B588A4D328F2A1D5.mof3⤵PID:3936
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0CBD6BDA858114EC196F6B41C2CFD3BF.mof3⤵PID:392
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0CCAA8293392639FBA830DD578DB2C02.mof3⤵PID:3032
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0D169F54EB7176F6BF264A5F8562C98B.mof3⤵PID:952
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0DA95863FE4B25CC2D43F0020902CB31.mof3⤵PID:2500
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0DAE6401EA75135DC71C2BF2727AE47F.mof3⤵PID:228
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0DC0A697FFCC592B72AABF89E4FD9156.mof3⤵PID:3696
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0E68BDAB79C00E0C496F8772703BB3AB.mof3⤵PID:4944
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0EA772F1A1EDFC2AEE10CC4E22899FA7.mof3⤵PID:5068
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0EACEE5F78D8DC364E3C886DBB50601B.mof3⤵PID:4852
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0EB7B5521B8E9A713CA5D4DE1135B365.mof3⤵PID:5048
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0EBA1F7B891BD5FE808E91F1D5467AFE.mof3⤵PID:1076
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0EBDDF573C99959D239BF0ADB48A18B5.mof3⤵PID:1868
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\0F6999175ECAE7FD86A81D5F3AC1FA46.mof3⤵PID:4472
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\100C683F4F92BE5F31DCF9E5E8F8A127.mof3⤵PID:4296
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\105E698CE1AE9FA053B763F2C80120D6.mof3⤵PID:2528
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\10D697E74C7A4CC694967A7BA1861EE7.mof3⤵PID:4784
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\10EDE1FE24EBC1EBE598FDE3A051CB83.mof3⤵PID:2616
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\11992DCCFDD62BD40E85DA67BD91FF88.mof3⤵PID:1904
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1228A6BDE4139369DF7DB4975C62A50A.mof3⤵PID:4412
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\128E25AF26A5FD60EC8421A35FE38114.mof3⤵PID:3452
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1364A1ACC2D182FC0E95C7573ADD0308.mof3⤵PID:464
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\13BC960D220197BCBCC7F1658C34102D.mof3⤵PID:952
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\153FCFE945068754B72A6FC011B37613.mof3⤵PID:1244
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\160386BCC54C67562570A808003698B2.mof3⤵PID:1296
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1641F982282E8CA70B0D93F1F2BB145B.mof3⤵PID:2376
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1671EBB4B246E464FCB7369EAB2831EF.mof3⤵PID:2420
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\16C850723D6D606824E3600992F717AC.mof3⤵PID:3628
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\16E269CB069C7242FB610AB48045318B.mof3⤵PID:4620
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\170119984F3AA426567DD71E8458DCA1.mof3⤵PID:4524
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\172412DF1F8338E4AD006E9F9788ED2A.mof3⤵PID:3556
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\173F0B14BCB5F1B2B2258AFA66FA1F6A.mof3⤵PID:3136
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\17BCA321685944580A77D03BECECF588.mof3⤵PID:3504
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\17CF414FA1DE5CE02A5C9AC66A2D8F5E.mof3⤵PID:1788
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\180E25D92AFCF71A996BC7AC24F27DD5.mof3⤵PID:2592
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\18194DF78686FCBACD0E6868ED0E0919.mof3⤵PID:2916
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1898EDEA64C511B1CB8EF5483101FB35.mof3⤵PID:2432
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\18B9AA34B315DE18655875C087F7E147.mof3⤵PID:4000
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\18F122357839ADA1419DDE2C541904BE.mof3⤵PID:1964
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\192325CD712AED7BF56940AD3BB9A176.mof3⤵PID:4848
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\195AE1B89E0FF6CD40670E98BAB3A608.mof3⤵PID:1220
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\198029E6BF51E6E158ECF68FF0B36E3A.mof3⤵PID:2636
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\19B9819A1C5AE6BC556E1A65834AEC13.mof3⤵PID:4604
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1A62F8CF28E9ED8FBDCEA3D28AC6D3EF.mof3⤵PID:4212
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1AA085F45F04FFF42F8B23EE4B1DD6D5.mof3⤵PID:3188
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1AEA6E68EBB34016ED94F24ABB9308E5.mof3⤵PID:1872
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1B15F9EA2C8E8A55CC1CBE63FB6B4840.mof3⤵PID:1068
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1B1859A081E5E0E923DE7CA17A3AD0E6.mof3⤵PID:3108
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1B243182F610F39F48F63ED2AAF2E4C6.mof3⤵PID:3556
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1BF02F5F261B4F6E08912C82760B1564.mof3⤵PID:4128
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1C57A0A063E5D1FAE814B23DFF99DA42.mof3⤵PID:2428
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1C6A987B4B0CF81C64F418964D02E590.mof3⤵PID:5072
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1D17F2812D61D6A27510A5356CBCB2C6.mof3⤵PID:2388
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1D2F2472E8915C165DD3667793DD6216.mof3⤵PID:2616
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1D39564B78F00E3F6ED4B4A5662781B2.mof3⤵PID:4228
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1D3D7B63AE783F3DBBD4FD9F43301BD1.mof3⤵PID:4680
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1D770486C382CDC6F1CD832E1D040FEF.mof3⤵PID:464
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1D8E83D3077F05426D7F5E7C92A52BC2.mof3⤵
- Drops file in System32 directory
PID:1728
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1DD21D310EE87FB8B3301E43E53F9548.mof3⤵PID:2588
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1E3959634C12CA1C92AEBB0AB0A0CD47.mof3⤵PID:4936
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1E50D6323FD92D3DDCD8B52937074C9C.mof3⤵PID:372
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1ED415C5FAB66F75A8BD9D906ED1FD79.mof3⤵PID:4024
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1F539B7D89D5675D5FBC71A5A1E7C62D.mof3⤵PID:4212
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1F5D7EA255DEC718E6C93AFC61039C12.mof3⤵PID:2420
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\1FD16EA55AB471DAD65A8AE31A92BFE1.mof3⤵PID:5104
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\20916DA71EC75FCC409872C3207D9C60.mof3⤵PID:3444
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\20EF0B41F86B67FBB71739AA19D6F941.mof3⤵PID:1508
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\210892B3C5033337B5C4FCD68AA35128.mof3⤵PID:3136
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2131A60D40501A974386B9E42E4FC201.mof3⤵PID:3736
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2174D8A485DAE80D1D90B7E5430F164F.mof3⤵PID:3288
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2215A345459824E0504DB85AEBB502CE.mof3⤵PID:1572
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\22C5E271CACABCBB6D1BF416CB483DB1.mof3⤵PID:4532
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\232692AF542DAC9C19624048D7BCE0F9.mof3⤵PID:3096
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\23FFA2BEE2CFCB552EEC22762785E6B4.mof3⤵PID:392
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\25CCB9BAD9B50F42124D935083535916.mof3⤵PID:2536
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\25CE4D0A477A7A536B1F5C9965A6C9E4.mof3⤵PID:4752
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\25E9A5A2000F7483536AEC7F5BBAD557.mof3⤵PID:628
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2794DD6CC13BD11ED558AA64C449E6D7.mof3⤵PID:952
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\28DFEEAE5E755E081510079AEA4BA2DB.mof3⤵PID:4068
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\29B55D1D5A0BB6BBFD2F6F1D35B3A1BB.mof3⤵PID:3384
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2A2AB14E79261C4C2272F4B50901244C.mof3⤵PID:1464
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2A8F8C0C68BF867A9E2A7AB38260A4F9.mof3⤵
- Drops file in System32 directory
PID:4476
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2B416E2919A9D497584044544D3C8433.mof3⤵PID:1492
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2BF259128A811B9C7417AEAD9F596A8E.mof3⤵PID:3188
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2C688638F731D0D535DBB9DA2F979753.mof3⤵PID:3668
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2C6A80FDED75E46CA733976E382559CC.mof3⤵PID:4620
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2C7CF4E1EA79BFA00DDAAADCB67FCA96.mof3⤵PID:4876
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2D1A849208186237BBED16B3B5D7238E.mof3⤵PID:840
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2DB099F474FFAB578AD726E4F2905FED.mof3⤵PID:3684
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2DFDBD25A9B159E6B632A69ADD81F446.mof3⤵PID:3736
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2E4D19AFECF3B4188F10CD16C8BB92E1.mof3⤵PID:2428
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2E60A4684212330C61E1E8704A619754.mof3⤵PID:980
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2EC8433E19B30A13955120CB32A18CFC.mof3⤵
- Drops file in System32 directory
PID:2708
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2F0CC20947142CB05C49044919898802.mof3⤵PID:636
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2F58A8772B1579A81054587DFC0A68CE.mof3⤵PID:3408
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\2FA567F6FE2F89694B594B3FAC75D6DF.mof3⤵
- Drops file in System32 directory
PID:1648
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\30711D4696101AA94690C8C51432F5E2.mof3⤵
- Drops file in System32 directory
PID:3700
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\30A5229E4F736548D2D9FA13F92C9A82.mof3⤵PID:2632
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\30C22E5728F64CE0E1605A4A77934948.mof3⤵PID:1656
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\30C3808B55CD6C563447B44FC4E9BAD8.mof3⤵PID:2588
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\30DFAF0BD5AD387D985719F41E186AD5.mof3⤵PID:1436
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\31998CC82EC1ED985097054B275161ED.mof3⤵PID:3384
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\32057A09A1167F6F66F16DA67DF1C918.mof3⤵PID:228
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3209C3555EE020AE8FA1C869C6A591D9.mof3⤵PID:2984
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\320EDC28FFEC3C708AB2DDE6C70FD624.mof3⤵PID:4264
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3281CFB9A42D9486C40C0A4D010D65E6.mof3⤵PID:872
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\329A6D1E4413466F2111A8B0F5C0A51B.mof3⤵
- Drops file in System32 directory
PID:4824
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\33295A3A1D28CAE3DFB6C5167CCAAE6F.mof3⤵PID:1544
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\33A13765948753719F44CA6F7E586909.mof3⤵PID:840
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\33B9B81C996ACC2B2000070519028F72.mof3⤵PID:3324
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\344FC63DB23C44805CA5C08EAC26522F.mof3⤵PID:3092
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\347C4407B808EB65CAFD16126D73D922.mof3⤵PID:3452
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\348C74BBB0C8791244D9BA708604211E.mof3⤵PID:4680
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\361C55667115751869AC74207D28DCE7.mof3⤵PID:3604
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\36A47C4202A2694FFD79C2BABBD02788.mof3⤵PID:2632
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\36AC724DE559C5D39EB46462A440D4E5.mof3⤵PID:1656
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3704297DA195A3B2DADC6D89B6226662.mof3⤵PID:2516
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\371088BC97F0585065A1A08ED83172D6.mof3⤵PID:2500
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3778D40681E80056E0C63E6CB18E9E37.mof3⤵PID:2132
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\37846654B2AF369ED3D0A3637E941D9B.mof3⤵PID:228
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\379E5EC415D0E0A49EFDD4B3564BE048.mof3⤵PID:1276
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\37D4F7E4435BDF811F1EC2CBA1EF4A10.mof3⤵PID:1168
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3855849167EAA03A99F4C8450E15A6ED.mof3⤵PID:4592
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\38841DF145EDAB1901F40F6B9A6AF4AA.mof3⤵PID:4296
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\38F922911FA0CAE637E5D1EB1013D0F1.mof3⤵PID:5032
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\395955902B64122A6EF58A130F284979.mof3⤵
- Drops file in System32 directory
PID:5072
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\39C2F82384C755EF218F0F19FE619F80.mof3⤵PID:4288
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3A2F8881A3B96DF2374FCEFB35545D6B.mof3⤵PID:780
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3A65AC537877D583303AEEF0342B5D51.mof3⤵PID:4572
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3A75BC18F00746E3EB756A5A8AB71D56.mof3⤵PID:4848
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3AF58951EB00AD264E4FCF4BA804D893.mof3⤵PID:464
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3B443485D5F96CA9554D404AA52A1633.mof3⤵PID:4344
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3B60B0417CAF81D69389063C334577F1.mof3⤵PID:740
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3BB167BC6A619E5D11B40C8B9F699327.mof3⤵PID:2588
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3BBB431B659936EB58D4574BC05768CD.mof3⤵PID:4844
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3C03DD39D967893238742C503189BA92.mof3⤵PID:640
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3C11F3A2BFB9588C467B72E02345362F.mof3⤵PID:4620
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3C90AAC6E581F57E99B164C33906BD30.mof3⤵PID:3244
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3CA3E3E8C27409E2288B236F5F414F56.mof3⤵PID:628
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3D486D2EBFD5C380959985A548DC1308.mof3⤵PID:2992
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3D7D7734943CA5F273BDA05F3E1FA20C.mof3⤵PID:2396
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3D93BA5591BD981C5D5D6E2BEFACAA50.mof3⤵PID:1168
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3DA405CE6ACE7B7A8320D68D317B9729.mof3⤵PID:180
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3EB36FAFDAE870DF05542C0B4AAAD7EF.mof3⤵PID:3576
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3EE2F37B4639F4307BAF0C707B092F7C.mof3⤵PID:5052
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3F78FC5E2CC6CFD8720C796D34A544F7.mof3⤵PID:5072
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\3FFDD473F026FB198DA9FA65EE71383C.mof3⤵
- Drops file in System32 directory
PID:3492
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4001CC0C4B56CFDE0493013FC1D9DD0F.mof3⤵PID:4960
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\407E61D88570FDFD5EC8891DBF9A3EBC.mof3⤵PID:1964
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\40E224B18F4493C1B8E43DBC496D8E68.mof3⤵PID:4848
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4136DDD03841D93F3D820441F60BE055.mof3⤵PID:3604
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\413CED83449192A10E66EAD24743140E.mof3⤵PID:4584
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\42CB2CBBDCBB0DB751E51FF6B279C524.mof3⤵PID:1296
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\430091E25BA6C7FE2FE5DC31776BEACC.mof3⤵PID:1244
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\434B7316BB2FAD82DC3E5784AC46B4A0.mof3⤵PID:4484
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\43535D7A73D735DEFF9DB83057553D39.mof3⤵PID:4420
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\435A088CDF6FE7426084E4B35C1E81C7.mof3⤵PID:1540
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\435FA4D2CAB38A1853F91A3BE8F89D4E.mof3⤵
- Drops file in System32 directory
PID:4620
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4371EC94BF996AF79B062599D10C927E.mof3⤵PID:64
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\43AC153E4DED1737C66AEC0C7EAD9430.mof3⤵PID:1432
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\43EDE2715871F08D0BEFB4C9DE69E247.mof3⤵PID:4476
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\441A12A68AB1A20902A131356BA4CF30.mof3⤵PID:872
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\44B487D5879BCD6C593C9066936D12AD.mof3⤵PID:2180
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\44C46B87678291B7CFBF7D8A6452D98D.mof3⤵PID:4296
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\45277ADB2DA919AFFF18833506353174.mof3⤵PID:3576
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4552656C2901FB1533D6679D49B69929.mof3⤵PID:2916
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4561B54041D5F414CB02373F78461708.mof3⤵
- Drops file in System32 directory
PID:2536
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\46F812454290EE1E870544BFEAC8C7EF.mof3⤵PID:1648
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4795058F848A6BA6FE24E0530CE2E2DF.mof3⤵PID:384
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\47C87AFF6DBF51980E7CA3E36C38B86B.mof3⤵PID:4752
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4846320185EA62FBD8507FD7A9D87E61.mof3⤵PID:4848
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\48959878DDCA03B0FA77D806C7C5D743.mof3⤵PID:812
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\49C04C47AB946E0864486F81F6E251BC.mof3⤵PID:1436
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4B69CC652B5189D5B2136DFDC5369593.mof3⤵PID:2588
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4B95063FF713676A54E7221DF8245C78.mof3⤵PID:2452
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4BD7268ABFF9CFF22DA57949025E2667.mof3⤵PID:5088
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4BE30AA8CC2C4C06B41336B9B3878B1E.mof3⤵PID:4372
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4BE9D6CB921FE137B78AE9960CDD98B0.mof3⤵PID:2616
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4C3FFB127B4E9B67BFACD89178DE3DA3.mof3⤵PID:2984
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4CCFEF2D31696D11C8735BD7C8BE14B9.mof3⤵PID:4212
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4D9BCF0F509C90FA86E1ED3A34E158A0.mof3⤵
- Drops file in System32 directory
PID:2184
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4DAE009EE0BC4B9ECA96E59E303AE1E5.mof3⤵PID:3188
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4E20565265CAAFBDB6BA1B1C1ADA9D96.mof3⤵PID:1268
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4E34C76D83E2430D779FE9AA17E87200.mof3⤵PID:1464
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4E8CF66DA5DBCEE8F47DFDDF0B14DEC0.mof3⤵PID:2676
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4E941341E008BE47EC9639A14271EBF0.mof3⤵PID:4556
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4EA32ABEBFE9B0697C450693940F1673.mof3⤵PID:4000
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4EB0E9424AFEF8E5D68D78C36620E253.mof3⤵PID:1536
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4EF05404F86FAFD7EDAB80262970585E.mof3⤵PID:3816
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4F4AD4093274B7A7FF28CDBD5AB3032C.mof3⤵PID:4152
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\4F7C501B863AFCFCE3AE018AC07191F9.mof3⤵PID:3500
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\50B277BD2B3C116DBC38CC2D1EB7D427.mof3⤵PID:452
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\50B5B38557DC642A4BC7282A0C8C4AA2.mof3⤵PID:740
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\50E7AE0A90085737B8F04CDF9460DBEA.mof3⤵PID:2448
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\50FC9EDA1918FBC981D89D0390125308.mof3⤵PID:2112
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\51588E4AC5E59453F329EBF5A215ACEC.mof3⤵PID:640
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\517ED769F6478117021531216F609C27.mof3⤵PID:1540
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\51B9369C31C913E211D29AA4D91D4747.mof3⤵
- Drops file in System32 directory
PID:3120
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5232DBC5D3EE8EBCEF6CCB4213399B9A.mof3⤵PID:1680
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5241D310A7F9B793E5E9EC39E65B7B44.mof3⤵PID:412
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\52DF56A47A08AD380228C64827D24548.mof3⤵PID:2548
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\531218B396F02B35771F8AD1965A574A.mof3⤵
- Drops file in System32 directory
PID:2396
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5312CF8C0E1EE738404F2A6E526EB4D0.mof3⤵PID:5032
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\536E5C7121076D413E48A32D54E26EA3.mof3⤵PID:4808
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\53C2FC20B111DA763C20CFDAF7624A26.mof3⤵PID:3964
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\53C824D10974E3D64CB1537B2770F4AD.mof3⤵PID:980
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\553C27B9785BAD9A0C6E81613DD3FCB4.mof3⤵
- Drops file in System32 directory
PID:4288
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\554B4465433438F4FF7B8D7AB981B555.mof3⤵PID:2044
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\555E8EEF9A21E3F26C263316A778E15F.mof3⤵PID:1728
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\55B1D144C8C3666C687E454A80906ECE.mof3⤵PID:1544
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\563EAFFF3BF92CE3F60EAEE4EB18BBB3.mof3⤵PID:464
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\568257F0F7CB54EB479EA5E39A4ACD57.mof3⤵PID:2516
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5731B1CD62369AA3EF2B861A7BACB2C5.mof3⤵
- Drops file in System32 directory
PID:1656
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\57985F4723464E47CF133A601D28906D.mof3⤵PID:2588
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\58766C70A633CC3A5AC9393E175CA63A.mof3⤵PID:1932
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\59481CB78111FB31D37EDAC9647FAFD8.mof3⤵PID:952
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5960F40D2AAABA9E743AFA7294468C25.mof3⤵PID:4552
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\59A5343CF85A83AE1E7B5EAFC71ABD66.mof3⤵PID:3120
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\59C780751B7740A822CCE33528AC1E14.mof3⤵PID:4264
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5A7BC66EEC954487F6D9911DEAF052BE.mof3⤵
- Drops file in System32 directory
PID:872
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5B18367075FE563AF4A12EA837278D84.mof3⤵PID:1048
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5B4B75183FE97E2D052EE74E519015F4.mof3⤵PID:4524
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5BE557A291C3EEB7FE628D8099DD0CD3.mof3⤵
- Drops file in System32 directory
PID:3316
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5C704EA3E7D7B64E50D00711FC13CD34.mof3⤵PID:3644
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5C81F6E368BC71D1D45E2D9206EA3FD0.mof3⤵PID:1400
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5C8CE9E608C8192171A5B93767FCC960.mof3⤵PID:2344
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5CFEE986112963509926EC8912E14D25.mof3⤵PID:4296
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5D75A4D5A6D14E6061698FB7BED0446A.mof3⤵PID:384
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5DFFB5C73CF04EE22E19BB74127846D8.mof3⤵PID:4404
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5E69759D567F673B36A59095A347BF07.mof3⤵PID:4584
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5EEE7ED3AD74F7D10B2058BB7C19B751.mof3⤵PID:464
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5F037A89915D44B8819F9FCFDE0B489E.mof3⤵PID:3540
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5F08E2D70EBF81C77FA4C99A0901A6C8.mof3⤵PID:1056
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\5FC405F33502FCF8B5292EFDDD9AE4FA.mof3⤵PID:4276
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\601C41633EC4EEE1FFE41D65491BABD5.mof3⤵PID:2112
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\60B3B69ABC4366405469AA15F5B33006.mof3⤵PID:4876
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\60C90B334F5FD0AD576CC5FFCECDFA9C.mof3⤵PID:2860
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\617D2BAEB248E81618E2D9342B7323AD.mof3⤵
- Drops file in System32 directory
PID:676
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6199F396C445A25AF1DE1CEFFF072560.mof3⤵PID:5068
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\61D0174ACBF8E43615E6DF8019C0583E.mof3⤵PID:4212
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\627EE3812DC7A5BF704C057D238F75AA.mof3⤵PID:3776
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\62FE034F36B9ACAF125049C4EB64D6A7.mof3⤵PID:4472
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6340973172727B5EBAF0A64E92C26B73.mof3⤵PID:2180
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6364E8D3F688917ECAE1050954B63674.mof3⤵PID:3936
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\63B2501D71A2DE162EA12C3CACF8C488.mof3⤵PID:2676
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\644B35DCD280DC69AED674005133C98E.mof3⤵PID:3492
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\64B4796A957F50D8E37415358DC4011F.mof3⤵PID:2316
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\64BE228C7C03C2D993371E5195306859.mof3⤵PID:516
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\652B32EA4449A9E8AF422E70ACDF46E4.mof3⤵PID:4328
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\653734ED42B7A9B62F119AAB8C9521D8.mof3⤵PID:4152
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\657F8341C743B485575944BF32E0125B.mof3⤵PID:2304
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\65DE946825EFC13018FEB489315181A4.mof3⤵PID:452
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\662DD1E431BC9D4EB784D7D662BF5114.mof3⤵PID:4204
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\66501D267ABECB2CF3315642D1881501.mof3⤵PID:4908
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\66B28EEE188E29399051A60BAF92D333.mof3⤵PID:3136
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6717E3CAA50A3943B61329778C1DD781.mof3⤵
- Drops file in System32 directory
PID:3180
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\671DBBDEA9073F2E4CCCFFF6957044E0.mof3⤵PID:2544
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\674888C18C2BA74E9DE8F74501330DC0.mof3⤵PID:3096
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6780F8CDE9A603E0A830C9603F2F4D0B.mof3⤵PID:2984
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6808D4839451264DD18BB2454D45479E.mof3⤵PID:2920
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\682277A939A770BB800CFE4F205D7891.mof3⤵PID:2184
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6874681F627A133631133FDFA2B4FB8D.mof3⤵PID:372
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\687CF9D31E514545A07747EE9CC567AB.mof3⤵PID:180
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\68882E3FA69BD52620343D172BE84815.mof3⤵PID:840
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\693BB2D22B37188C506A30563317E1D8.mof3⤵PID:4488
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6984662FE0A2CC634E49E525D17376AA.mof3⤵PID:3092
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6BCCCB82E5792A665667D7E41CC45168.mof3⤵PID:2536
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6BFD34C0EBE9B3A34F525B51261858DF.mof3⤵PID:2316
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6CBA7FE164696851E3674A4FC046F926.mof3⤵PID:3924
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6CC07C0289722A5549B9C30F76C249FF.mof3⤵PID:1880
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6CC685AEFC129C8DD86F9036F17E943C.mof3⤵PID:4404
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6CD4AC2A2B648ABFE8F2F90A5D07829F.mof3⤵PID:4584
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6CDB91CE30082B98FE1BEE23E422804C.mof3⤵PID:464
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6CE4D05BA5B97F5FAAA40312E14F0E81.mof3⤵PID:4204
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6D15B1C3AE92D91DCD86360CCC4F53B4.mof3⤵PID:3504
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6DADEFFF2FCEDD93F8CEF59036FEF4B9.mof3⤵PID:1508
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6E5FACACD2BA0A27C7AE761291F7BED1.mof3⤵PID:1068
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6F2F026E4006B8443E4D6AD8DC43B8EF.mof3⤵PID:2420
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\6F606DA76B5A34FEC3A95B874DC14C2F.mof3⤵PID:1680
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\70121DE772621FEB6480A1C9A3475D5A.mof3⤵PID:676
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\70138AC07076B005E1CFA39BC5BD9175.mof3⤵PID:5068
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\71E680EC580A0039A775A378ECD836FF.mof3⤵PID:4264
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7282BB1A61AFF7E0656732EE80CEB6FD.mof3⤵PID:4128
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\732BD24D0DF3B5E7191B301E55CDD6D6.mof3⤵PID:4524
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\738F657B98502C3F07A67FDC669EB8AB.mof3⤵PID:3576
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\739CB6904442C4B4092104AACB73DBB0.mof3⤵PID:3408
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\73C8F1FE9282D72F1684DA13FF1346AA.mof3⤵PID:1084
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7402D0FB5599777D401744FC6DD201D7.mof3⤵PID:5072
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\740FBFCE4E4515C86E8C7E9D18A58DF4.mof3⤵PID:4296
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\742B2F1B414C6E566B6BDF87D12D8AA4.mof3⤵PID:3008
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7450D0DEE62770FF1E5C905B1BAFD42E.mof3⤵PID:384
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\74AF2F8E62D0745F958B573494C439C8.mof3⤵PID:1116
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\74E621F5E9C4849D83DAC55AC565A76B.mof3⤵PID:864
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\757421178679BC54A733A7C4F3DAA07B.mof3⤵PID:1296
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\75B8AD308277AE2AEFCDEA0B6A7C3C0C.mof3⤵PID:1056
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\75F3B2B3A615155BFB2E7C19531A197A.mof3⤵PID:3136
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\76118EA7CDB4BF4005AD84DDF6CE2E66.mof3⤵PID:812
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\76367CD152E34AC3DD8007741C968AF4.mof3⤵PID:4552
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\76A3CA62703735BDC186B9056247C8F7.mof3⤵PID:3120
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7716BDB243C38A4A24E728B3817AE0F1.mof3⤵PID:4476
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\77E1FE7C589B0FE237874F7EE517A0C1.mof3⤵PID:3512
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\785C9F9CED5D122AD92D6BC91312F7FC.mof3⤵PID:1012
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7891546B010C902B9C8DE33F55F71498.mof3⤵PID:4228
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\78C249F8A099AEA6A25F33F09F50FB47.mof3⤵PID:2180
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7950D68C8C6F669B94D3E488F0B6BEAB.mof3⤵PID:3644
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\79EF8F616077A833BE2747809180BFA5.mof3⤵PID:1464
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\79FE6B25E5B132F33880B7F44A66B758.mof3⤵PID:980
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7C6FCEE9F64D2CC890D867AB97DEE424.mof3⤵PID:780
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7C7E3220AE92EC87E0436ADE3F5D9931.mof3⤵PID:1096
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7D1DA389789509D61D1AB66097581992.mof3⤵
- Drops file in System32 directory
PID:4328
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7D60FA9CA39C59A4B7C96DEFCF0B1B01.mof3⤵PID:556
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7D8C933AA5FE34FA3316DA4B6E09E654.mof3⤵PID:2632
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7DD87359B51EDB79AC235F97E726EF5A.mof3⤵PID:3540
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7E12C6950CA7714D731D5313649CA457.mof3⤵PID:2500
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7E19C857E35FA8D70E57B0F1CB21E5C7.mof3⤵PID:4156
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7E856BB33FFDA1141B90AC29735FB9FA.mof3⤵PID:1056
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7EAB83B6B5BC37690D2D1B3E22DF7D9E.mof3⤵PID:640
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7F3DC6EFFFDCCEBC37B17C2FDC124638.mof3⤵PID:3608
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7FAB1F3A2B36D6EA27A3DB4EC39C7BD0.mof3⤵PID:3244
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\7FAC187A43CA71A854CA4653D8E075B5.mof3⤵PID:2548
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\80064700E82C89F9D3E945021BA8C32C.mof3⤵PID:3628
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\80571CB6E9439E1C98BA9AC3FA28D3A9.mof3⤵PID:1048
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8096010E847A7DE3A3F69A61002DD563.mof3⤵PID:1012
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8151A5CF9B90099D16EDB3EADE4C8CD3.mof3⤵PID:4228
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\818B866A009B1338C5AC103B2D8E2372.mof3⤵PID:5052
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\81FCAC08918AF581FDCB45931E356981.mof3⤵PID:4112
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8243D67DDA3785DAD59ACF70CFC203DE.mof3⤵PID:1360
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8266DC592F01723A90239C659F1FA6C7.mof3⤵PID:2044
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\82DA351296066664DEB012FCCF6D07AA.mof3⤵PID:2316
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\82DA415A8C75204A2D758E6DAD53BC36.mof3⤵PID:3500
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\82DFEA0FE38074528C86FA0695FC7E37.mof3⤵PID:4752
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\82FED0C3319594CCF4117CB3B34B5F72.mof3⤵PID:2636
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8349431AF468BA55DBFB84FC50CC17C5.mof3⤵PID:2320
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\83E1D5D490B9335941305F44058A6755.mof3⤵PID:864
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\843980BE43ABA52AC77C57DF068D59B1.mof3⤵PID:1580
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\846AC8E6E788D5BDCFBB697A233A8993.mof3⤵PID:4276
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\84BA101DF0936E1318EE1EB10539C9CD.mof3⤵PID:3384
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\84EBC179129822B0E00C47B7528F1FDC.mof3⤵PID:1056
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\84FD82C473BCBDEA6CFCD53DF80D6022.mof3⤵PID:2860
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8588C815441547988C5E4B9CC6CF7351.mof3⤵PID:4016
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\85917F125E29280A85EDFCDC3B0C8170.mof3⤵
- Drops file in System32 directory
PID:1564
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\868B5F1DDD5C341C50C0D359CD22F37B.mof3⤵PID:3776
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\869B30EA34E0F5E56CCBB130AAC2BFA1.mof3⤵PID:1012
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\86CAC2AF84F4546D81A07C72C8591F6A.mof3⤵PID:3108
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\86F4330E57637679ACB9F17E5F9481D1.mof3⤵PID:316
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\86F83A7235F3DC2A6FCDEC052E1E1C74.mof3⤵PID:3408
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\87218B3AEA759A53DCCA78D6B9BBC66F.mof3⤵PID:2344
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\875B0EAE58DBE30E13A8DB610457D0AD.mof3⤵PID:2512
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\87C0585DEAE72716889B524A66D1B5A3.mof3⤵PID:1244
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\886EC825992F9DCB7AF34306DA80E12D.mof3⤵PID:3008
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\88C20208CDD4638C0381F2B7EC657564.mof3⤵
- Drops file in System32 directory
PID:1384
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8935BD8F59955F30D52E141E311891AB.mof3⤵PID:4692
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8999FA8F96032A452671DE654F9BAD9C.mof3⤵PID:864
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\89FA1168564BA2D42E7C412972B44BB5.mof3⤵PID:1580
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8BA44FC08995F15033A9F5D56C8BFC72.mof3⤵PID:4372
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8BC8F7B477D3C6C3184AD0372AEE53F6.mof3⤵
- Drops file in System32 directory
PID:3180
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8BDE235F11AF9276AB26638F45341094.mof3⤵
- Drops file in System32 directory
PID:2112
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8BF0E140F8F40D230143B569A1BAE507.mof3⤵PID:3120
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8C11323D7C773C8A79C1C61EB62FE331.mof3⤵PID:4852
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8CB4C42331F0F4BBCC8E1580131EDCE2.mof3⤵PID:412
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8CBA2BE847D0B28A440C5F24567B0891.mof3⤵PID:1172
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8DB46DD597956632ECDB18D7B2BDF70E.mof3⤵PID:2504
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8DB9DE86229327C5777721E4A01FB6B4.mof3⤵PID:2916
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8E733CB38D1CDCF7377912244F95A3ED.mof3⤵PID:1904
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8E84BA6D260667ADAAD89BFECDD627CB.mof3⤵PID:3612
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8ECBCCCC7B4A9C11EC33A03B6E25EA5B.mof3⤵PID:408
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8EE122F840F244E3AE065AF9ADB16CCD.mof3⤵
- Drops file in System32 directory
PID:3032
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8F07ADF9734C090207F52CC2C29F17AF.mof3⤵PID:5072
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8F1ECB08E7908F5D543B0D9386C0EE1B.mof3⤵PID:1964
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8FAA7CD5955A0D5862A90FAA2B0A56F4.mof3⤵PID:3924
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\8FCABF54BDCC2D55C8203E3B81BAC5FF.mof3⤵PID:2636
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\901B1F181D1D82C168094975DEFB52F3.mof3⤵PID:2920
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\902F9B116F0B37B699E9A1D4BB1E2784.mof3⤵PID:3244
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\90B516E096C71C814FF03EE3F4B20042.mof3⤵PID:4692
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\92EFA8432E609D6F315DD0A3CB41E1E8.mof3⤵PID:864
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\930C5E176BA9A3D78B730BC00CDDF64E.mof3⤵PID:1580
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\945C37C794BCB294DBA8E445FF2C9DB6.mof3⤵
- Drops file in System32 directory
PID:4372
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9476FC534A628F39C9E25CA2F2B7B45E.mof3⤵PID:3180
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\94D3468248838C60F808E50FC66A40D0.mof3⤵
- Drops file in System32 directory
PID:4552
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\953349B5ECB359DD058D07088EA31408.mof3⤵PID:4264
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\95C6129A16411671ED974764CC24C800.mof3⤵PID:180
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\95E06CE9FC028717015354732A36A6C1.mof3⤵PID:3240
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\960C76B3B2B322906970277571EF6F3C.mof3⤵PID:5028
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\966B95F249EDF54D9BE98C23AD9B758A.mof3⤵PID:3108
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9694C920807304FD0F9730304298FBFC.mof3⤵
- Drops file in System32 directory
PID:1696
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\96E2369FBCFC254F09B1EA2AF6E7641A.mof3⤵
- Drops file in System32 directory
PID:1360
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\97479A7EBC4B4FA9A0F0C7EF9A25471D.mof3⤵PID:4296
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9772382673B9BD1FECD8DED342DC39F8.mof3⤵PID:4328
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9787DADF23D03D83A63DC8237E63E3EB.mof3⤵PID:3604
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\979FEF94607A8F13E19684C45FAA30EE.mof3⤵PID:2260
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\97C10655E91CC076C4E294C0127D974B.mof3⤵PID:2516
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\97D74F86BDAAADB7B4674A2E199ED992.mof3⤵PID:556
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9823053171CF53F4038B0801004F87BC.mof3⤵PID:4936
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\98A650FE1443CF2F953B6628EE432373.mof3⤵PID:4344
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\99BB0F4219E2381969DCE76BF639AC68.mof3⤵PID:2500
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\99BFB05D8CE546325B5205C32233A3BD.mof3⤵PID:4424
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9A977B776702BB9FBB29D1FCCF5F778B.mof3⤵PID:1580
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9B0C875B0F6F2F48FB2B5C587F50979C.mof3⤵PID:4372
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9B1ABD0CEAE78416529CB8D77CEE7B3A.mof3⤵PID:3096
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9B75C712017ED3DA97BEA0D4949BFA74.mof3⤵PID:5104
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9B7AE939DC5E63135058FA28EB025C7C.mof3⤵PID:4016
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9B9501A9E26093612D20F39A895DA307.mof3⤵PID:2532
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9C1784EBA4E907589027FCF72DE4C0AD.mof3⤵PID:4288
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9C44AA8B16C47059241530441BCD6DD9.mof3⤵PID:2180
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9C531048714B59E157A371D1186F796E.mof3⤵PID:3108
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9CFE6E9E20D61400007C08E31ED048B4.mof3⤵PID:1696
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9D40E5B032950BC9770539F90AD86275.mof3⤵PID:408
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9DB628ECA9373F2BA3BCBB592AF60665.mof3⤵PID:1220
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9DEA7F87EAEC9FF8770E55D5A6D8CC91.mof3⤵PID:4152
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9E8B373EB1451CC4B43C871707D12D3D.mof3⤵PID:4848
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9ED719089FF4652F4929D88C64B6A1AD.mof3⤵PID:4684
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9EF608904C4706610FDA20D08530978E.mof3⤵PID:1408
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9F39E54D6756FE5D64BB6FED194D0894.mof3⤵PID:2632
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9FC7214EDE76F8AE24F96A8195852557.mof3⤵PID:1528
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\9FD6F6552A18165F88BF080B1B4DF1DD.mof3⤵PID:2132
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A03E3718C1B8425EB481A1EC4850275F.mof3⤵PID:952
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A067787F4F1B728DE125898181C42609.mof3⤵PID:1912
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A0A63361726BDAE3BC29B11F7526AFE6.mof3⤵
- Drops file in System32 directory
PID:1276
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A0CC7ED8939B47C1ED00EB9F04D19EB0.mof3⤵PID:4372
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A0DE0DD786E0E9020C3DFD7004E42694.mof3⤵PID:4944
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A16EB1FCF4FDFE5542D9FE85FCF4F0E0.mof3⤵PID:5104
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A269D70CB8C799952AAD6684D1506485.mof3⤵PID:4128
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A2D118894CA6FCC71ACC7DD86296B7A8.mof3⤵PID:1400
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A30FD18C5DC0924B89944F8ADE638E27.mof3⤵PID:4288
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A396597A6767121F681B483A4B28ABDB.mof3⤵PID:2180
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A39A3B3270FEF11AE8ACF901E67BE359.mof3⤵PID:1904
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A46C038124134B1482949A1DF8ABB385.mof3⤵PID:2044
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A572284932D45BDC47401871C2E01043.mof3⤵PID:408
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A5B62AD916B641B7A8365E1C7C9C7544.mof3⤵PID:1220
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A5E0C63B1E67223D493A65CA08D7339B.mof3⤵PID:2260
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A71089353F923E1FA26964C3E8153739.mof3⤵PID:2420
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A7463B23BFE582993515A0109F19D304.mof3⤵PID:2300
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A7D7570238274B86C73F2E9009BDF74F.mof3⤵PID:1408
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A808A31E629557CF0D5F92D5D87BD706.mof3⤵PID:2632
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A837677C21EC0ECFEB9B10CCD2FEB0E5.mof3⤵PID:968
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A88BC3FD19AFFF0EF5E5DD4A97F9B953.mof3⤵PID:4844
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A93568B935C29F9AA2B5DC62D4964431.mof3⤵PID:4156
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A945F8B7098A596A55A7303B78BC8CF1.mof3⤵PID:4484
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A97B345CDEAABDA620BFB72AD2A07100.mof3⤵PID:2984
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\A9FBCB4593D76446A380C3F3421BC2A7.mof3⤵PID:940
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AA10CCACD6B301F2187572F1FD684AC5.mof3⤵PID:4944
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AA510EA6AD14A8BE52A7D659281F9BF3.mof3⤵PID:3668
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AA6235372BA3751E1E4C601E6263D02E.mof3⤵PID:1048
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AA69B9C8BBEB509BBB296FEDD7B5ED23.mof3⤵
- Drops file in System32 directory
PID:2456
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AB2AD61FC9800DD5C7751E4270E02730.mof3⤵PID:4112
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AB3EC8C66F16D96107223E8469ACA854.mof3⤵PID:3816
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AB545518DC0F250493CCF5B36A459568.mof3⤵PID:516
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AB947196AECC60D0365253863489134A.mof3⤵PID:3700
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\ABA2825A827A4760BD2251B8B781B271.mof3⤵PID:1436
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AD20F64F9DDBB4AB72E615A132B55377.mof3⤵PID:4940
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AD4ADD965106D211E524A76F9B368A14.mof3⤵PID:412
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AD6E370A764693BABD73A1B75D243F0B.mof3⤵PID:1872
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\ADEE1E4F403A605328D0002B7C6CA9C7.mof3⤵PID:3188
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AE25594AECD77BF35F6E794162F4DD77.mof3⤵PID:1408
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AE796E3468AD0D0C250FAA45259E22DB.mof3⤵PID:2632
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AE8C8067E61E868B002C481CE87EBE05.mof3⤵PID:968
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AF451AB4377D22C64822DE9E01B1F4E8.mof3⤵
- Drops file in System32 directory
PID:4844
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AF45D4D704EA10EA55742D1B3C8C6CE2.mof3⤵PID:2544
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AF8191ADF52F4156FF8D54FB39842A54.mof3⤵PID:2312
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AF83007CC746311C7050A636C44C02DA.mof3⤵PID:4552
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AFC3C909161915255AC43F522C25B858.mof3⤵
- Drops file in System32 directory
PID:4456
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AFD8B7D322EE2A1CB2BAF41EC0ADF626.mof3⤵PID:3316
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AFE689599143A3C959EC6ED84C5AE1F9.mof3⤵PID:5104
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\AFF15E95C194C0034BFE43E5853DEE63.mof3⤵PID:4128
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B0ABD547895829AB29B56F0812CBB823.mof3⤵PID:1400
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B0C53BEE6C437337AB024CECEE878418.mof3⤵PID:2388
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B10EF7584FC5D16C42403B0CA5BD4DFF.mof3⤵PID:4160
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B1FD5C4B728DEE34C2744E42C11D8760.mof3⤵PID:3492
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B250BBA224E8A08823993336C7CB7011.mof3⤵PID:4296
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B25479026E9AAB36CBEBFF51AA0E32B5.mof3⤵PID:4680
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B308B28244CE4219C4C6B3315FA83200.mof3⤵PID:1220
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B471CD3F6DA41643CF1F5221FE3E4CF9.mof3⤵PID:2164
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B48FFF8D8BB2AE842F6650E8DE95B954.mof3⤵PID:4476
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B54261EAEEB4A0D8DB966E20CBEF7E52.mof3⤵PID:3540
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B551DA824528E06A014274837CB2A9CB.mof3⤵PID:232
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B5DC6196F95A004EDD1453C12599676B.mof3⤵PID:1728
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B6752671A157884075FCC12BEDFB4D69.mof3⤵PID:3384
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B67D454E426E9AEB60ED08DCC946B44B.mof3⤵PID:1268
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B6AF1E27DD1C8095A2887A3BECBB76EF.mof3⤵PID:1680
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B7133C48CF1507759D1561876C9BA27B.mof3⤵PID:2984
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B7840CBF63A47839AD6AD9F714E4D9BB.mof3⤵PID:2448
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B789D76E1E0DE4569B56F6FE22E05621.mof3⤵PID:1564
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B7DD4F9016C2EF03ADB325C37FC76454.mof3⤵PID:1016
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B845DD492B0CE12D87559CED569DE6B1.mof3⤵PID:2504
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B8870014FB74FB540F3C31EA907A2AE7.mof3⤵PID:3576
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\B9B14FBAD84A7125C53EEE7706842C5B.mof3⤵PID:4960
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BA42233C2B9592211C49858860047F3F.mof3⤵PID:3980
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BA4AF8E4FEBF32A044146607E11B336E.mof3⤵PID:4160
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BAE93F9B141EC7983B2E3379E3E9119E.mof3⤵PID:4764
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BAE9A5FB11B68C3A726881B291D669F6.mof3⤵PID:384
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BB9039F6B76054E97E7EFE906C52DE12.mof3⤵PID:408
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BCB9C29787770EE14EFCAC19CF508F66.mof3⤵PID:2516
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BD557D61619F268BDCEA21C2BDB91514.mof3⤵PID:412
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BD5A24FC505850E33FAACDC4DBFAD85D.mof3⤵PID:4024
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BD818313E410FD46A9F63786A32AEE23.mof3⤵PID:3784
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BD880669B37B14C73AF9195DB3A20F28.mof3⤵PID:1932
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BE8B60428F91B5F96E778F2B2C2832A5.mof3⤵PID:4604
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BE8E9D8246C687F5C062F5D47DA1199A.mof3⤵PID:4424
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BEB55E5308BFA4DC17987F4D0DF04295.mof3⤵PID:1580
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BEE3F1CC0769E4FD5954E4E649614722.mof3⤵PID:3532
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BF15B53EBA3B9699B34F0453D41230A0.mof3⤵PID:1276
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BF7B61BA8D8284B7D0DA637AB41F6C96.mof3⤵PID:680
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\BF7BF74A57B2030A3BB9979E14C311F1.mof3⤵PID:1572
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C03089ABF5861ADFD1F7C923D2F9A153.mof3⤵PID:3964
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C08E9222775EF82A98E5CDD931ACC633.mof3⤵PID:4916
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C09DD3CA03ADBEEE3ABD0ADF668D9848.mof3⤵PID:1460
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C0E71AD79C7DB91864FCD17ECFDE1E10.mof3⤵
- Drops file in System32 directory
PID:3452
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C1A0E85153900845F7BA78472B952007.mof3⤵
- Drops file in System32 directory
PID:1540
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C1A41FBCA25E3E6CC4CD22064882728F.mof3⤵PID:1464
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C1D36889746E38D1BC7C314F51AC80E6.mof3⤵PID:1936
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C1FA58EA827D44CFBEE4F63536677F65.mof3⤵PID:4068
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C23F41A19D7EC249FDA170C05916CB8F.mof3⤵PID:384
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C25A6E589BBE06A55DB5B350B80152B1.mof3⤵PID:408
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C274B92CA0AA0BC1531712AF28602FDD.mof3⤵PID:3496
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C291730B7DFE0290D98702FB8F8B0F1E.mof3⤵PID:3192
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C2CD968A064AA98DCC1CC37592A142C7.mof3⤵PID:4024
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C304206E30795E3A6539B5DF349C4270.mof3⤵PID:3188
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C39C0F5D0934BAE90B29A93BEADC257F.mof3⤵PID:1668
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C3C4860D945FD1716E55A2D7AFA8C55D.mof3⤵
- Drops file in System32 directory
PID:1728
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C3F80855FDF5A3E423EBABF12EB64064.mof3⤵
- Drops file in System32 directory
PID:64
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C40B30214E633F7974F2729FAE1BC67D.mof3⤵PID:3608
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C54E46EF4D4F454E2C3ACD269B67494E.mof3⤵PID:1068
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C55F973EDD4E17F6A7CA6F8DC77AC2E8.mof3⤵PID:3148
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C599AFA5A6F053BAD70179501868318E.mof3⤵PID:4240
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C5A7A3340CB4BCC7A5C994052DAB1A78.mof3⤵PID:4800
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C5E5CB06F45AEA0FE31FFD0A0F94194E.mof3⤵PID:3964
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C67614C3E48ABD4BC9E709E2CEB2CE53.mof3⤵PID:1960
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C685465F4F6FC210421DA7E9DD550821.mof3⤵PID:1460
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C687C1EAD6B670CCBAA60909B89F62CB.mof3⤵
- Drops file in System32 directory
PID:980
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C70550846DA118E1E660A10136A7ECA7.mof3⤵PID:3696
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C77491DD5CBE96FF7C3528A0FD4A1410.mof3⤵PID:2044
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C7999B0462D8EAC32E2ED3A9D0017C97.mof3⤵PID:2388
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C7AD207ED7993A4809373AC7E5784F42.mof3⤵PID:4152
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C8306578B5F0D111675384D271B4DAE3.mof3⤵PID:3056
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C87E3190BEFC663A6A04D6D857ABE30E.mof3⤵PID:1080
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C890A36E670146004F5FA6D96F4C069C.mof3⤵PID:1880
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\C98344F72C7B0FA5F30F1BF6877B4E25.mof3⤵PID:2808
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\CA1BF3536958E01F710E5995DE6EBE31.mof3⤵PID:2300
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\CA519EE48C39BDA3C1538E5565C377FA.mof3⤵PID:4024
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\CAC0434A24FA3D5F69B4858EAA050C64.mof3⤵PID:1932
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\CCFBB6F691A0FA96C5B605CD9D80173B.mof3⤵PID:4604
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\CD3047E52420EB014D24A73F8DD48F55.mof3⤵PID:640
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\CD658FA16F96D4466BFE68FCE874D955.mof3⤵PID:4844
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\CDB59C31DC153347DDACAC08113F8015.mof3⤵PID:1268
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\CDC6E4754252FF7D0E8F3C134D265A60.mof3⤵PID:4020
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\CDDB319981A500F42CBEC98CD2362007.mof3⤵PID:2996
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\CDEEE4A36DD31A28218DBF5A1A529CFD.mof3⤵PID:3684
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\CE096445AF8F836B82205BD4E80E5A94.mof3⤵PID:2184
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\CE7FA5E0DC28E4C7BB0A2AA22DE05392.mof3⤵PID:4808
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\CF3C74ACDD4465D23E06A73A9D97DFFD.mof3⤵PID:2916
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\CF4667947FCFC2F62078D3B85CE7EF10.mof3⤵PID:676
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D003EAB9BB96C7DF227404C6B2582455.mof3⤵PID:4000
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D02971809B01C7E099D44E7A1436F997.mof3⤵PID:1696
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D04911ACFCA47446EFCB01393D3C3F8B.mof3⤵PID:3720
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D05C15A4875D58D36F57187E7FE4496A.mof3⤵PID:1924
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D05E5243F9713AD9C0F710C5DE549BE2.mof3⤵PID:3696
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D06E9123D0C50409B7B9F35A8222CADA.mof3⤵PID:2112
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D0E5935486BD6AD49D80F66B81B985DE.mof3⤵PID:3040
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D17469C68898749E23D53128870A755C.mof3⤵PID:2344
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D1C240EDA191362672EF6FCCB9725F85.mof3⤵
- Drops file in System32 directory
PID:2532
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D2412702F385FCB9E6709FB33EB27BDF.mof3⤵
- Drops file in System32 directory
PID:4940
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D256B700C202A9389F73688CDED83B7E.mof3⤵PID:1872
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D2EF06310A52FBA8DF0B6BDFC0D3C664.mof3⤵PID:5024
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D2FA07FC4043B26B5CB97692C2AAFF12.mof3⤵PID:2320
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D3B2EC2F727A45FED5DC9D6BD0BC833D.mof3⤵PID:4680
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D48232953788C625160D278B29B5D73D.mof3⤵PID:1544
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D4D422DBE282F1B12C3A82517EB0D59D.mof3⤵PID:636
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D4F56CCD124A6B24576AF721B0282383.mof3⤵
- Drops file in System32 directory
PID:4428
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D566F9B651B60AE7D0B5DEBF57A90E35.mof3⤵PID:968
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D64EE91A31A31FCBEAA727029795B289.mof3⤵PID:1056
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D69C7ED8E3B896ACD98229CB4DC363B6.mof3⤵PID:3572
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D6E15C5FE0484F1B1192CEC9DD7DCE6A.mof3⤵PID:3096
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D6F45CA88F2F5527EC301A7FA3FF5B8C.mof3⤵PID:2312
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D75AD6809E604BB6F018E54A8482C928.mof3⤵PID:916
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D7B94FF620323D536A3B99CCAA6B78DA.mof3⤵PID:1172
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D7E06DA4457A14F49A9A996F22881130.mof3⤵PID:3628
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D8401E2EC2C3AFBC1A21717167BA8734.mof3⤵PID:1564
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D8A32838B23AD6809B3B7858DA93D26B.mof3⤵PID:4488
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D8D1C602836BEF743D38740FCA8D4B8B.mof3⤵PID:3548
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D92BDDCE5396A2FDB5F2208AE47E7CE1.mof3⤵PID:3612
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D9D86DD1D8501C39B4325827BB6F2270.mof3⤵PID:1904
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D9DD8F6664E786227542BCC5FCF66D2D.mof3⤵PID:3440
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D9E59C2E17E0CE2AC75DA8E34E9214D0.mof3⤵PID:2316
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\D9EB7BAFBC23534E43B93A69CFD89687.mof3⤵PID:516
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\DA27AF57C09E80A784709AD6239EA23B.mof3⤵PID:3500
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\DA54B44152345FC1E1817702B2A34D5D.mof3⤵PID:2592
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\DA5B702F94B3636728C005C0E5C0A6BE.mof3⤵PID:4764
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\DA736886F13A0E2EE2265319FB376753.mof3⤵PID:4848
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\DAC96F2A49E2484740F118A3CDF28EA3.mof3⤵PID:2972
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\DAEC8125C10A9D1FB182920A9FDE141A.mof3⤵PID:3496
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\DB347A2F84FBE8E0965F9BCF8D6FD7E2.mof3⤵PID:2516
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\DB54C5562A50379EFADA86F9B3861ABC.mof3⤵PID:4200
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\DB81A681168E125300B192421B05FF69.mof3⤵PID:4204
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\DB9B568A06C456FE484FF58A5FB76350.mof3⤵PID:4500
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\DBB76BE22686E5E05D908137FA7CB031.mof3⤵PID:2500
-
-
C:\Windows\System32\wbem\mofcomp.exemofcomp C:\Windows\System32\wbem\AutoRecover\DBC6F0EF775A987FD56E1909BCBEF6E4.mof3⤵PID:3136
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1780
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4556,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:81⤵PID:2304
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:5080
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:872
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc1⤵PID:4468
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Component Object Model Hijacking
1Server Software Component
1Terminal Services DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD537893f40606e44ae8c4df07d20ca87bf
SHA18d9cf4fe4576756d623d3b39c947e92b24f40794
SHA2567ddce7b8887d0fe1ed38e3c7e9a9f8e246f3f8f97198b100429762ad842621db
SHA5121eafda889387ffb95e85ccdcb61037e7092fbd7b256610606b951994835424fa606f3c39397b8df79130c6073fed5505ab07edbc1d7309a28fd4a6e608c9a77e
-
Filesize
142KB
MD51bd26a75846ce780d72b93caffac89f6
SHA1ff89b7c5e8c46c6c2e52383849bbf008bd91d66e
SHA25655b47d0f965800c179a78314b6489d02788a44fa2ce00f68b2d860440216927a
SHA5124f5e14637e9e89700f1ee2d0e575d26d4f3d164d859487f1471bf4410dec6d0d7dbf552c6f791c12388be035c6b974610cda8882c6394438e2220b79e4d74e9e
-
Filesize
147KB
MD56d4b430c2abf0ec4ca1909e6e2f097db
SHA197c330923a6380fe8ea8e440ce2c568594d3fff7
SHA25644f8db37f14c399ea27550fa89787add9bfd916ffb0056c37f5908b2bac7723e
SHA512cf28046fb6ab040d0527d7c89870983c02a110e9fe0ecf276395f080a3bd5745b920a79b3ce3bb820d7a5a878c0d13c37f67f4b5097245c5b93ca1111c1e830b
-
Filesize
141KB
MD56adbb878124fcd6561655718f12bff5f
SHA11711619dda04178fb47eea6658da6ad52f6cf660
SHA2560b16ac631d596f85f0062dbe5da238c0745bd4c033207cba2508465c7c7983cf
SHA51288ec8b3c4670970900ef8fdaf0865e24a5bbc9c0ca375eb6ce12e8d8a3ec08c8a45dfc8ae3c7f4ff1974d5e4b53e0905c5dffadb852e730eb8097a22cd750006
-
Filesize
138KB
MD5d4b57c62c54e6f62c2239177730248d8
SHA17d81fe1eac0d666aaa01064cbcdf51c1d44db819
SHA2567fb738ffc037deb30ac1aa843af1dfed6772fcae0055e409ff6f5cd7b651716b
SHA5129939e6835587f814ab575a4ba616f151ef649bac79b207b3536fe38228ebfd55ce50d1bd17d4dc3c11aefc8d421a7c20bee13ffc4a314915a7e50a5e4ce13e6f
-
Filesize
125KB
MD5eef14d868d4e0c2354c345abc4902445
SHA1173c39e29dbe6dfd5044f5f788fa4e7618d68d4d
SHA2569f32176066529c5699d45728fcad1bccce41d19dded4649b49cb24f7eef9ce7f
SHA512c926f13a0fc900dd7d740e2d7d33cdd1902ece0bfb44b6e1f5fed6ffd348c3e7d71089fb9792e38799e8df6573bc09e67bbe132cf9c2ae0a7199534dc5d959ee
-
Filesize
710KB
MD582d7f8765db25b313ecf436572dbe840
SHA1da9ed48d5386a1133f878b3e00988cbf4cdebab8
SHA2563053aa67e9cb37cd6f9645ef3bec8d43b1863afd852d3860ea73fcd83c7010c3
SHA51259766b408b548dc020b54c79a426b361112c33c7263c16ca2e69485dadca05fb4c63b6433063e77c6a9e28a43ec6d3c8206ea702a33b79151fa6309d83b316a8
-
Filesize
680KB
MD5407f4fed9a4510646f33a2869a184de8
SHA1e2e622f36b28057bbfbaee754ab6abac2de04778
SHA25664a9d789cc9e0155153067c4354e1fc8baf3aa319fa870a2047482450811f615
SHA5121d420ea7ac787df81bbc1534e8fac89227f54fffff70c08c6d2da385762e6c5766448ab4a47aae1c5cbc671776522b6fb6d9c27870b505ae101462bce912867e
-
Filesize
754KB
MD54e62108a0d4a00aa39624f4f941d2595
SHA17fbff1d3ac293c715a303ac37da0ceb12591028b
SHA2563df3adaa8bd1ec4dd99bf304c7a1b0d513097fbeb8648efad4b127c5522c3263
SHA512c79a483e4012d8c97f4a2188fdc27ea04bae24993b12487551872f1413a1a0884197dc71d13ba1dfd32c9b2c93089761f6f3ec37f0bb19e209dbf19283462126
-
Filesize
758KB
MD5b87c7ea0e738fc61eb32a94fbd6c6775
SHA10e730aa70900f623205b93cb1d6e11be4c0d51b5
SHA2566cd8b09f644b22c39e02af26b57580baa0fbed01b682d158b29c676d17dac5c0
SHA5124bad64af992b17a5700cf25ccfa299b2db5be846b8bc28233fa6987964994a34694eb53329ede8d04092298e4b16f06563e459692c210111e0420ee34468f23d
-
Filesize
747KB
MD5af84da8efc4350425986bd8d1f9e4aa2
SHA1d475f5d5003d2152d8f9d976fd762b474e0857fc
SHA256802e68c2a17427e31589ee76fba78534fa56612d7b20dcdba0c468b06be13e75
SHA5126ef39476f69635ef1891deb43f251f4077030b3478d771409c84940f9f6128ee4850ee04687cda923816421935ba3cd06ca3e381a3af9e3e17f105f5aa9fc7c6
-
Filesize
462KB
MD5906500b906ff5714abfb310609a6207e
SHA1e085597f06df2b986f482f37d6077247d76c0cba
SHA25682df03abd566227a4ec99ceae023f79d5886e93b425ecc4a54f53452593f60f1
SHA51254c5b7cc290aeb34c93c7c1301d90aac2a1190d6e92893b86264682d91930df9e91c644a00c566841031efc3a0c71322106b8c1ce679e026930094c778e77b96
-
Filesize
435B
MD51cc4c3b9bb1657be77939f0b565e315d
SHA16a7ff123e96da6f7fb0fd9b7d7600bfc3540ee25
SHA2569eb3cbb0f65809845890159efdab0ff5a910da34252e7d5cff2929cc2fa6ab6a
SHA512fd461013902cf1f89485efc1cbdd07bc294253a1b60d9950e27cdb12937cbb39e3491ddb5dfdc4386df87fa44ee4ca9b3be01d7048850337ff9d68156eea78ef
-
Filesize
1KB
MD5a656a56b1fda4aa28383160ba6ebea3b
SHA1bda09bb6f5f28f5470147113e93d46a02853dfe1
SHA256639cf8acd1fe25a19b9841c9262b4227fcc33bb6658919d31b10ab849253b318
SHA512fbc74c738bbebb6265688ebec7a6bce18f5a59e98a5417701e5565d5c6e1f8c350da000005fc7441f8a4622043d4a8fd62efe54308cfa59f4ce9ed027dadebae