Found string "%WINDIR%\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002596-00000C40-155") Found string "WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00000740-00000BC0-9703705456631422") Found string "wmic,processorArchitecture="X86",type="win32",version="1.0.0.0"C:\Windows\system32\wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00000740.00000000.68394.00040000.00000002.mdmp, 00000000-00000740.00000000.68402.00040000.00000002.mdmp") Found string "WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00000740.00000000.68394.000E0000.00000004.mdmp, 00000000-00000740.00000000.68402.000E0000.00000004.mdmp") Found string "C:\Windows\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00000740.00000000.68394.003B0000.00000004.mdmp, 00000000-00000740.00000000.68402.003B0000.00000004.mdmp") Found string ":\Windows\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00000740.00000000.68394.003B0000.00000004.mdmp, 00000000-00000740.00000000.68402.003B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00000740.00000000.68394.003B0000.00000004.mdmp, 00000000-00000740.00000000.68402.003B0000.00000004.mdmp") Found string "TEXT>root\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00000740.00000000.68394.00473000.00000004.mdmp, 00000000-00000740.00000000.68402.00473000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00000740.00000000.68394.00473000.00000004.mdmp, 00000000-00000740.00000000.68402.00473000.00000004.mdmp") Found string " path win32_LocalTime Get Day,Month,Year /valuebQ0KJvf83Troot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00000740.00000000.68394.00473000.00000004.mdmp, 00000000-00000740.00000000.68402.00473000.00000004.mdmp") Found string "MAND SEQUENCENUM="1" ISSUEDFROM="bQ0KJvf83T" STARTTIME="07-26-2023T19:23:37" EVERYCOUNT="0"> path win32_LocalTime Get Day,Month,Year /valuebQ0KJvf83Troot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00000740.00000000.68394.00473000.00000004.mdmp, 00000000-00000740.00000000.68402.00473000.00000004.mdmp") Found string " path win32_LocalTime Get Day,Month,Year /valuebQ0KJvf83Troot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON2672023" (Indicator: "root\cimv2"; in Source: "00000000-00000740.00000000.68394.00473000.00000004.mdmp, 00000000-00000740.00000000.68402.00473000.00000004.mdmp") Found string " path win32_LocalTime Get Day,Month,Year /valuebQ0KJvf83Troot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON2672023" (Indicator: "root\cimv2"; in Source: "00000000-00000740.00000000.68394.00473000.00000004.mdmp, 00000000-00000740.00000000.68402.00473000.00000004.mdmp") Found string "MAND SEQUENCENUM="1" ISSUEDFROM="bQ0KJvf83T" STARTTIME="07-26-2023T19:23:37" EVERYCOUNT="0"> path win32_LocalTime Get Day,Month,Year /valuebQ0KJvf83Troot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON2672023" (Indicator: "root\cimv2"; in Source: "00000000-00000740.00000000.68394.00473000.00000004.mdmp, 00000000-00000740.00000000.68402.00473000.00000004.mdmp") Found string "ONTEXT>root\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00000740.00000000.68394.00720000.00000004.mdmp, 00000000-00000740.00000000.68402.00720000.00000004.mdmp") Found string "wmic.exe" (Indicator: "wmic.exe"; in Source: "00000000-00000740.00000000.68394.FFF03000.00000002.mdmp, 00000000-00000740.00000000.68402.FFF03000.00000002.mdmp") Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00002672.00000000.68282.00380000.00000004.mdmp, 00000000-00002672.00000001.68454.00380000.00000004.mdmp") Found string "WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002672.00000001.68454.00380000.00000004.mdmp")