13241300x8000000000000000135637Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FDH4SRN-SetValue2026-03-23 16:00:43.079{b0004b8c-63a9-69c1-74d3-010000005702}4980C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\RemoteAccess\RouterManagers\Ip\GlobalInfoBinary DataNT AUTHORITY\SYSTEM 13241300x8000000000000000135636Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FDH4SRN-SetValue2026-03-23 16:00:43.079{b0004b8c-63a9-69c1-74d3-010000005702}4980C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\RemoteAccess\RouterManagers\Ip\DLLPath%%SystemRoot%%\System32\iprtrmgr.dllNT AUTHORITY\SYSTEM 13241300x8000000000000000135635Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FDH4SRN-SetValue2026-03-23 16:00:43.079{b0004b8c-63a9-69c1-74d3-010000005702}4980C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\RemoteAccess\RouterManagers\Ip\ProtocolIdDWORD (0x00000021)NT AUTHORITY\SYSTEM 13241300x8000000000000000135603Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FDH4SRN-SetValue2026-03-23 16:00:41.185{b0004b8c-63a9-69c1-6bd3-010000005702}6024C:\Windows\system32\reg.exeHKLM\System\CurrentControlSet\Services\RemoteAccess\RouterManagers\Ip\TestDLLC:\Users\Administrator\Downloads\hello.dllEC2AMAZ-FDH4SRN\Administrator 13241300x8000000000000000135601Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FDH4SRN-SetValue2026-03-23 16:00:41.169{b0004b8c-63a9-69c1-6ad3-010000005702}3420C:\Windows\system32\reg.exeHKLM\System\CurrentControlSet\Services\RemoteAccess\RouterManagers\Ip\(Default)(Empty)EC2AMAZ-FDH4SRN\Administrator