Found string "%WINDIR%\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00004964-00000C47-1432907854") Found string "%WINDIR%\System32\wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00004964-00000BC0-2596252962") Found string "WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00004512-00000BC0-2597070502") Found string "C:\WINDOWS\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00004512.00000000.230148.1E610000.00000004.mdmp") Found string ":\WINDOWS\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00004512.00000000.230148.1E610000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00004512.00000000.230148.1E610000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\ROOT\CIMV2" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000000.230148.1E610000.00000004.mdmp") Found string ":\windows\system32\wbem\wmic.exe" (Indicator: "wmic.exe"; in Source: "00000000-00004512.00000000.230148.1E656000.00000004.mdmp") Found string "TEXT>root\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000000.230148.1E656000.00000004.mdmp") Found string "UEST> share where "name='NETLOGON'" get pathDESKTOP-FVVF82Aroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000000.230148.1E656000.00000004.mdmp") Found string "UEST> share where "name='NETLOGON'" get pathDESKTOP-FVVF82Aroot\cimv2root\cliIMPERSONATEPK" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000000.230148.1E656000.00000004.mdmp") Found string "ROOT\CIMV2:Win32_DiskDrive" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000000.230148.BE10E000.00000002.mdmp") Found string "wmic.exe" (Indicator: "wmic.exe"; in Source: "00000000-00004512.00000000.230148.BE12B000.00000002.mdmp")