4688201331200x8020000000000000335360Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x1024C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335362Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x165cC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335361Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70xac4C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335363Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x1384C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335365Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x12a4C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335364Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70xa80C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335366Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70xd8C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335368Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x1b8C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335367Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x814C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335369Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x139cC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335370Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x1680C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335371Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x494C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335372Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x11a4C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335373Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x1580C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335375Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x1340C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335374Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x1294C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335376Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70xf54C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335377Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x1250C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335378Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x12b4C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335379Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x176cC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335380Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70xb6cC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335382Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x12a8C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335381Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x11d4C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335383Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70xe28C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335384Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x11e4C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335385Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x1064C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335386Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70xae0C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335387Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x17c0C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335388Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x1424C:\Windows\System32\backgroundTaskHost.exe%%19380x2f0"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mcaATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2C:\Windows\System32\svchost.exeMandatory Label\Low Mandatory Level 4688201331200x8020000000000000335389Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x10c8C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335391Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x9e8C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335390Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x129cC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335392Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x774C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335394Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x138cC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000335393Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x600C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4776001433600x8010000000000000391604Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0JZLBZIINWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391603Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0UZGSFMGIWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391602Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0MEAFWNDRWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391601Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0VHBXUFKEWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391600Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0PAQTLQXWWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391599Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0NCNRJZTAWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391598Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0EORRAPCJWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391597Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0HDABBPBTWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391596Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0HXJTVSDPWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391595Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0TOYEUOFEWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391594Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0PZXIAUHMWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391593Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0OVEXQUKSWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391592Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0EUOHFHDNWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391591Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0OOGGQXYDWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391590Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0XKROWGMRWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391589Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0BGANNKAJWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391588Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0SGGNTBUWWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391587Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0CPIUTSJDWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391586Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0PJRGDQIYWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391585Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0VNXHOMVXWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391584Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0IWNJWZRSWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391583Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0VSHGYNNQWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391582Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0VTYWBLRPWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391581Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0RFXPKGKRWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391580Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0KUFEMBYHWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391579Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0DZBMABNJWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391578Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0TUVONMBFWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391577Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0SVGXDBDEWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391576Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0BXXLGZZNWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391575Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0SZYRQWAEWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391574Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0HRTQLQDOWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391573Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0FKZGCKNFWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391572Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0VHOTLYTEWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391571Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0OGACGGCMWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391570Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0LMAMHCHFWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391569Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0LDKTTUTLWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391568Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0RAFNYQZGWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391567Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0AACECLCLWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391566Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0VFRKKMDGWIN-HOST-MVELAZ0xc0000064 4625001254400x8010000000000000335434Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDJZLBZIINattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335433Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDUZGSFMGIattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335432Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDMEAFWNDRattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335431Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDVHBXUFKEattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335430Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDPAQTLQXWattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335429Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDNCNRJZTAattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335428Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDEORRAPCJattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335427Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDHDABBPBTattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335426Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDHXJTVSDPattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335425Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDTOYEUOFEattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335424Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDPZXIAUHMattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335423Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDOVEXQUKSattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335422Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDEUOHFHDNattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335421Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDOOGGQXYDattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335420Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDXKROWGMRattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335419Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDBGANNKAJattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335418Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDSGGNTBUWattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335417Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDCPIUTSJDattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335416Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDPJRGDQIYattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335415Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDVNXHOMVXattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335414Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDIWNJWZRSattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335413Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDVSHGYNNQattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335412Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDVTYWBLRPattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335411Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDRFXPKGKRattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335410Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDKUFEMBYHattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335409Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDDZBMABNJattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335408Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDTUVONMBFattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335407Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDSVGXDBDEattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335406Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDBXXLGZZNattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335405Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDSZYRQWAEattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335404Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDHRTQLQDOattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335403Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDFKZGCKNFattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335402Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDVHOTLYTEattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335401Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDOGACGGCMattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335400Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDLMAMHCHFattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335399Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDLDKTTUTLattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335398Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDRAFNYQZGattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335397Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDAACECLCLattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335396Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDVFRKKMDGattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4688201331200x8020000000000000335395Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f20x1370C:\Tools\PurpleSharp\PurpleSharp.exe%%19380x314PurpleSharp.exe /pb pb.jsonNULL SID--0x0C:\Windows\System32\cmd.exeMandatory Label\Medium Mandatory Level 4776001433600x8010000000000000391615Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0KSYLEFUAWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391614Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0VJBLEVCZWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391613Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0DAHLZCLLWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391612Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0EMRURUMJWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391611Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIEAJWCMWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391610Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0KZAVHCJVWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391609Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0WMOBRKDPWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391608Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0BTNUUJFEWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391607Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0WYYLKERJWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391606Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0SJEEYNDCWIN-HOST-MVELAZ0xc0000064 4776001433600x8010000000000000391605Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0RVWSOEPHWIN-HOST-MVELAZ0xc0000064 4625001254400x8010000000000000335445Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDKSYLEFUAattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335444Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDVJBLEVCZattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335443Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDDAHLZCLLattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335442Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDEMRURUMJattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335441Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDWIEAJWCMattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335440Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDKZAVHCJVattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335439Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDWMOBRKDPattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335438Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDBTNUUJFEattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335437Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDWYYLKERJattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335436Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDSJEEYNDCattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4625001254400x8010000000000000335435Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2NULL SIDRVWSOEPHattackrange.local0xc000006d%%23130xc00000642Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0WIN-HOST-MVELAZ--00x1370C:\Tools\PurpleSharp\PurpleSharp.exe-- 4688201331200x8020000000000000335446Securitywin-host-mvelazco-02713-447.attackrange.localNT AUTHORITY\SYSTEMWIN-HOST-MVELAZ$ATTACKRANGE0x3e70x165cC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe%%19360x7d4"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level