154100x800000000000000062359Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2025-07-29 09:42:00.174{E4B49A97-9768-6888-5F01-00000000F103}5668C:\Windows\System32\rundll32.exe10.0.14393.4169 (rs1_release.210107-1130)Windows host process (Rundll32)Microsoft® Windows® Operating SystemMicrosoft CorporationRUNDLL32.EXErundll32.exe C:\Users\ADMINI~1\AppData\Local\Temp\tmp12345.dll,MessageBoxThreadC:\Temp\test\ATTACKRANGE\Administrator{E4B49A97-9495-6888-9179-410000000000}0x4179912HighMD5=23DB802097F7B7E520E40068A7E68B14,SHA256=28DE7D3E8BF4B19E44063A4BFC2E7C30AE488CD9A1F63320ED374E14AAECA667,IMPHASH=7D1CE1BAFE48B63D9D19E8E0E5DF3E6C{E4B49A97-9749-6888-5A01-00000000F103}6124C:\Windows\System32\cmd.exe"cmd.exe" /s /k pushd "C:\Temp\test"ATTACKRANGE\Administrator 154100x800000000000000062302Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2025-07-29 09:41:53.533{E4B49A97-9761-6888-5C01-00000000F103}1612C:\Windows\System32\rundll32.exe10.0.14393.4169 (rs1_release.210107-1130)Windows host process (Rundll32)Microsoft® Windows® Operating SystemMicrosoft CorporationRUNDLL32.EXErundll32.exe C:\Users\ADMINI~1\AppData\Local\Temp\tmp12345.dllC:\Temp\test\ATTACKRANGE\Administrator{E4B49A97-9495-6888-9179-410000000000}0x4179912HighMD5=23DB802097F7B7E520E40068A7E68B14,SHA256=28DE7D3E8BF4B19E44063A4BFC2E7C30AE488CD9A1F63320ED374E14AAECA667,IMPHASH=7D1CE1BAFE48B63D9D19E8E0E5DF3E6C{E4B49A97-9749-6888-5A01-00000000F103}6124C:\Windows\System32\cmd.exe"cmd.exe" /s /k pushd "C:\Temp\test"ATTACKRANGE\Administrator