Found string ""wmic.exe" csproduct get uuid" (Indicator: "wmic.exe"; in Source: "00000000-00004000-00000C47-65440704630") Found string "C:\Windows\System32\Wbem\wmic.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002328.00000000.83540.001DB000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00002328.00000000.83540.00E81000.00000020.mdmp") Found string "wmic.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002328.00000000.83546.00120000.00000004.mdmp, 00000000-00002328.00000000.83546.00ECD000.00000002.mdmp") Found string " csproduct get uuidHAPUBWS-PCroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00002328.00000000.83546.0022A000.00000004.mdmp") Found string " csproduct get uuidHAPUBWS-PCroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00002328.00000000.83546.0022A000.00000004.mdmp") Found string "OMMAND SEQUENCENUM="1" ISSUEDFROM="HAPUBWS-PC" STARTTIME="08-12-2026T06:50:34" EVERYCOUNT="0"> csproduct get uuidHAPUBWS-PCroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AONE1D81142-19C7-2930-FB23-8E3F02254A39" (Indicator: "root\cimv2"; in Source: "00000000-00002328.00000000.83546.0022A000.00000004.mdmp") Found string " csproduct get uuidHAPUBWS-PCroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AONE1D81142-19C7-2930-FB23-8E3F02254A39" (Indicator: "root\cimv2"; in Source: "00000000-00002328.00000000.83546.0022A000.00000004.mdmp") Found string "wmic.exe" (Indicator: "wmic.exe"; in Source: "00000000-00004000.00000001.83705.01B80000.00000004.mdmp") Found string ""wmic.exe" cspro" (Indicator: "wmic.exe"; in Source: "00000000-00004000.00000001.83705.01B80000.00000004.mdmp") Found string ""wmic.exe" csproduct get uuid" (Indicator: "wmic.exe"; in Source: "00000000-00004000.00000001.83705.01B80000.00000004.mdmp") Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00004000.00000001.83705.01B80000.00000004.mdmp")