154100x8000000000000000741120Microsoft-Windows-Sysmon/Operationalar-win-dc-2025-10-31 14:09:39.580{CA8A6768-C323-6904-5A0B-00000000FB03}3732C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exerundll32 C:\Windows\System32\shell32.dll #61C:\Temp\AR-WIN-DC\Administrator{CA8A6768-9E3A-6904-4D9C-1E0000000000}0x1e9c4d2HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{CA8A6768-C323-6904-570B-00000000FB03}6768C:\Temp\castlerat_semifix_s.exe"C:\Temp\castlerat_semifix_s.exe" AR-WIN-DC\Administrator 154100x8000000000000000741111Microsoft-Windows-Sysmon/Operationalar-win-dc-2025-10-31 14:09:39.575{CA8A6768-C323-6904-590B-00000000FB03}3620C:\Program Files\Google\Chrome\Application\chrome.exe142.0.7444.60Google ChromeGoogle ChromeGoogle LLCchrome.exe-no-deelevateC:\Temp\AR-WIN-DC\Administrator{CA8A6768-9E3A-6904-4D9C-1E0000000000}0x1e9c4d2HighMD5=4EBA7DFA7744CBEB6F5DB56C96135A14,SHA256=39C9678919F701BF38FC54B265BA9AAE0F18BC15A17523EFAEBB9B7C560F9682,IMPHASH=3E82AE93B8102462DDA81604AF164E8E{CA8A6768-C323-6904-570B-00000000FB03}6768C:\Temp\castlerat_semifix_s.exe"C:\Temp\castlerat_semifix_s.exe" AR-WIN-DC\Administrator 154100x8000000000000000741104Microsoft-Windows-Sysmon/Operationalar-win-dc-2025-10-31 14:09:39.571{CA8A6768-C323-6904-580B-00000000FB03}7152C:\Program Files\Google\Chrome\Application\chrome.exe142.0.7444.60Google ChromeGoogle ChromeGoogle LLCchrome.exe--mute-audio --do-not-de-elevateC:\Temp\AR-WIN-DC\Administrator{CA8A6768-9E3A-6904-4D9C-1E0000000000}0x1e9c4d2HighMD5=4EBA7DFA7744CBEB6F5DB56C96135A14,SHA256=39C9678919F701BF38FC54B265BA9AAE0F18BC15A17523EFAEBB9B7C560F9682,IMPHASH=3E82AE93B8102462DDA81604AF164E8E{CA8A6768-C323-6904-570B-00000000FB03}6768C:\Temp\castlerat_semifix_s.exe"C:\Temp\castlerat_semifix_s.exe" AR-WIN-DC\Administrator 154100x8000000000000000740961Microsoft-Windows-Sysmon/Operationalar-win-dc-2025-10-31 14:09:39.324{CA8A6768-C323-6904-570B-00000000FB03}6768C:\Temp\castlerat_semifix_s.exe-----"C:\Temp\castlerat_semifix_s.exe" C:\Temp\AR-WIN-DC\Administrator{CA8A6768-9E3A-6904-4D9C-1E0000000000}0x1e9c4d2HighMD5=E140483BC0747A8D18516201273B463D,SHA256=AFB1389A7B631166D0B155582BB0D105D8942413FF806BF02BF3312EF371CE1A,IMPHASH=351592D5EAD6DF0859B0CC0056827C95{CA8A6768-C323-6904-550B-00000000FB03}5132C:\Temp\castlerat_semifix_s.exe"C:\Temp\castlerat_semifix_s.exe" AR-WIN-DC\Administrator 154100x8000000000000000740865Microsoft-Windows-Sysmon/Operationalar-win-dc-2025-10-31 14:09:39.056{CA8A6768-C323-6904-550B-00000000FB03}5132C:\Temp\castlerat_semifix_s.exe-----"C:\Temp\castlerat_semifix_s.exe" C:\Temp\AR-WIN-DC\Administrator{CA8A6768-9E3A-6904-4D9C-1E0000000000}0x1e9c4d2HighMD5=E140483BC0747A8D18516201273B463D,SHA256=AFB1389A7B631166D0B155582BB0D105D8942413FF806BF02BF3312EF371CE1A,IMPHASH=351592D5EAD6DF0859B0CC0056827C95{CA8A6768-9E3B-6904-4E05-00000000FB03}3352C:\Windows\explorer.exeC:\Windows\Explorer.EXEAR-WIN-DC\Administrator 154100x8000000000000000728867Microsoft-Windows-Sysmon/Operationalar-win-dc-2025-10-31 14:08:13.194{CA8A6768-C2CD-6904-350B-00000000FB03}7080C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exerundll32 C:\Windows\System32\shell32.dll #61C:\Temp\AR-WIN-DC\Administrator{CA8A6768-9E3A-6904-4D9C-1E0000000000}0x1e9c4d2HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{CA8A6768-C2CC-6904-320B-00000000FB03}300C:\Temp\castlerat_semifix_s.exe"C:\Temp\castlerat_semifix_s.exe" AR-WIN-DC\Administrator 154100x8000000000000000728854Microsoft-Windows-Sysmon/Operationalar-win-dc-2025-10-31 14:08:13.188{CA8A6768-C2CD-6904-340B-00000000FB03}392C:\Program Files\Google\Chrome\Application\chrome.exe142.0.7444.60Google ChromeGoogle ChromeGoogle LLCchrome.exe-no-deelevateC:\Temp\AR-WIN-DC\Administrator{CA8A6768-9E3A-6904-4D9C-1E0000000000}0x1e9c4d2HighMD5=4EBA7DFA7744CBEB6F5DB56C96135A14,SHA256=39C9678919F701BF38FC54B265BA9AAE0F18BC15A17523EFAEBB9B7C560F9682,IMPHASH=3E82AE93B8102462DDA81604AF164E8E{CA8A6768-C2CC-6904-320B-00000000FB03}300C:\Temp\castlerat_semifix_s.exe"C:\Temp\castlerat_semifix_s.exe" AR-WIN-DC\Administrator 154100x8000000000000000728848Microsoft-Windows-Sysmon/Operationalar-win-dc-2025-10-31 14:08:13.172{CA8A6768-C2CD-6904-330B-00000000FB03}5520C:\Program Files\Google\Chrome\Application\chrome.exe142.0.7444.60Google ChromeGoogle ChromeGoogle LLCchrome.exe--mute-audio --do-not-de-elevateC:\Temp\AR-WIN-DC\Administrator{CA8A6768-9E3A-6904-4D9C-1E0000000000}0x1e9c4d2HighMD5=4EBA7DFA7744CBEB6F5DB56C96135A14,SHA256=39C9678919F701BF38FC54B265BA9AAE0F18BC15A17523EFAEBB9B7C560F9682,IMPHASH=3E82AE93B8102462DDA81604AF164E8E{CA8A6768-C2CC-6904-320B-00000000FB03}300C:\Temp\castlerat_semifix_s.exe"C:\Temp\castlerat_semifix_s.exe" AR-WIN-DC\Administrator 154100x8000000000000000728687Microsoft-Windows-Sysmon/Operationalar-win-dc-2025-10-31 14:08:12.925{CA8A6768-C2CC-6904-320B-00000000FB03}300C:\Temp\castlerat_semifix_s.exe-----"C:\Temp\castlerat_semifix_s.exe" C:\Temp\AR-WIN-DC\Administrator{CA8A6768-9E3A-6904-4D9C-1E0000000000}0x1e9c4d2HighMD5=E140483BC0747A8D18516201273B463D,SHA256=AFB1389A7B631166D0B155582BB0D105D8942413FF806BF02BF3312EF371CE1A,IMPHASH=351592D5EAD6DF0859B0CC0056827C95{CA8A6768-C2CC-6904-300B-00000000FB03}5572C:\Temp\castlerat_semifix_s.exe"C:\Temp\castlerat_semifix_s.exe" AR-WIN-DC\Administrator 154100x8000000000000000728605Microsoft-Windows-Sysmon/Operationalar-win-dc-2025-10-31 14:08:12.597{CA8A6768-C2CC-6904-300B-00000000FB03}5572C:\Temp\castlerat_semifix_s.exe-----"C:\Temp\castlerat_semifix_s.exe" C:\Temp\AR-WIN-DC\Administrator{CA8A6768-9E3A-6904-4D9C-1E0000000000}0x1e9c4d2HighMD5=E140483BC0747A8D18516201273B463D,SHA256=AFB1389A7B631166D0B155582BB0D105D8942413FF806BF02BF3312EF371CE1A,IMPHASH=351592D5EAD6DF0859B0CC0056827C95{CA8A6768-9E3B-6904-4E05-00000000FB03}3352C:\Windows\explorer.exeC:\Windows\Explorer.EXEAR-WIN-DC\Administrator