Found string "WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002652-00000BC0-29530088") Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00001732.00000000.71526.005E0000.00000004.mdmp, 00000000-00001732.00000000.71532.005E0000.00000004.mdmp") Found string "WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00001732.00000000.71526.005E0000.00000004.mdmp, 00000000-00001732.00000000.71532.005E0000.00000004.mdmp") Found string "wmic,processorArchitecture="X86",type="win32",version="1.0.0.0"C:\Windows\system32\wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002652.00000000.71597.00040000.00000002.mdmp, 00000000-00002652.00000000.71603.00040000.00000002.mdmp") Found string "WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002652.00000000.71597.00070000.00000004.mdmp, 00000000-00002652.00000000.71603.00070000.00000004.mdmp") Found string "C:\Windows\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002652.00000000.71597.001B0000.00000004.mdmp, 00000000-00002652.00000000.71603.001B0000.00000004.mdmp") Found string ":\Windows\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002652.00000000.71597.001B0000.00000004.mdmp, 00000000-00002652.00000000.71603.001B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002652.00000000.71597.001B0000.00000004.mdmp, 00000000-00002652.00000000.71603.001B0000.00000004.mdmp") Found string "TEXT>root\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00002652.00000000.71597.0027A000.00000004.mdmp, 00000000-00002652.00000000.71603.0027A000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00002652.00000000.71597.0027A000.00000004.mdmp, 00000000-00002652.00000000.71603.0027A000.00000004.mdmp") Found string " path win32_LocalTime Get Day,Month,Year /valueBvvnY1cG6oroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00002652.00000000.71597.0027A000.00000004.mdmp, 00000000-00002652.00000000.71603.0027A000.00000004.mdmp") Found string "MAND SEQUENCENUM="1" ISSUEDFROM="BvvnY1cG6o" STARTTIME="08-19-2023T20:39:16" EVERYCOUNT="0"> path win32_LocalTime Get Day,Month,Year /valueBvvnY1cG6oroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00002652.00000000.71597.0027A000.00000004.mdmp, 00000000-00002652.00000000.71603.0027A000.00000004.mdmp") Found string " path win32_LocalTime Get Day,Month,Year /valueBvvnY1cG6oroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON1982023" (Indicator: "root\cimv2"; in Source: "00000000-00002652.00000000.71597.0027A000.00000004.mdmp, 00000000-00002652.00000000.71603.0027A000.00000004.mdmp") Found string " path win32_LocalTime Get Day,Month,Year /valueBvvnY1cG6oroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON1982023" (Indicator: "root\cimv2"; in Source: "00000000-00002652.00000000.71597.0027A000.00000004.mdmp, 00000000-00002652.00000000.71603.0027A000.00000004.mdmp") Found string "MAND SEQUENCENUM="1" ISSUEDFROM="BvvnY1cG6o" STARTTIME="08-19-2023T20:39:16" EVERYCOUNT="0"> path win32_LocalTime Get Day,Month,Year /valueBvvnY1cG6oroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON1982023" (Indicator: "root\cimv2"; in Source: "00000000-00002652.00000000.71597.0027A000.00000004.mdmp, 00000000-00002652.00000000.71603.0027A000.00000004.mdmp") Found string "wmic.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002652.00000000.71597.FFD93000.00000002.mdmp, 00000000-00002652.00000000.71603.FFD93000.00000002.mdmp")