Found string "root\cimv2" (Indicator: "root\cimv2"; in File: "00000000-00002196.00000000.74894.00D41000.00000020.mdmp") Found string "WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002196-00000BC0-172962666") Found string "ONTEXT>root\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00002196.00000000.74894.002CA000.00000004.mdmp") Found string " diskdrive where "DeviceID=\'c:\'" get SerialNumber /valueHAPUBWS-PCroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00002196.00000000.74894.002CA000.00000004.mdmp") Found string " diskdrive where "DeviceID=\'c:\'" get SerialNumber /valueHAPUBWS-PCroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00002196.00000000.74894.002CA000.00000004.mdmp") Found string "OMMAND SEQUENCENUM="1" ISSUEDFROM="HAPUBWS-PC" STARTTIME="08-23-2026T04:24:13" EVERYCOUNT="0"> diskdrive where "DeviceID=\'c:\'" get SerialNumber /valueHAPUBWS-PCroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00002196.00000000.74894.002CA000.00000004.mdmp") Found string " diskdrive where "DeviceID=\'c:\'" get SerialNumber /valueHAPUBWS-PCroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON0x80041017Invalid query" (Indicator: "root\cimv2"; in Source: "00000000-00002196.00000000.74894.002CA000.00000004.mdmp") Found string "OMMAND SEQUENCENUM="1" ISSUEDFROM="HAPUBWS-PC" STARTTIME="08-23-2026T04:24:13" EVERYCOUNT="0"> diskdrive where "DeviceID=\'c:\'" get SerialNumber /valueHAPUBWS-PCroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON0x80041017Invalid query" (Indicator: "root\cimv2"; in Source: "00000000-00002196.00000000.74894.002CA000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00002196.00000000.74894.002CA000.00000004.mdmp, 00000000-00002196.00000000.74894.00D41000.00000020.mdmp") Found string "wmic.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002196.00000000.74894.00D8D000.00000002.mdmp")