4624201254400x80200000000000008434614Securityar-win-dc.attackrange.localNULL SID--0x0ATTACKRANGE\AdministratorAdministratorATTACKRANGE.LOCAL0xd16f33KerberosKerberos-{47D408F4-BB41-654C-3503-7E3CAE044FB1}--00x0-fe80::b1d0:27e2:167d:290e50115%%1833---%%18430x0%%1842 4624201254400x80200000000000008433137Securityar-win-dc.attackrange.localNULL SID--0x0ATTACKRANGE\AdministratorAdministratorATTACKRANGE.LOCAL0xd16f33KerberosKerberos-{DDB52289-D3AB-C7BE-A266-64A7568433F6}--00x0-fe80::b1d0:27e2:167d:290e49929%%1833---%%18430x0%%1842 4624201254400x80200000000000008432849Securityar-win-dc.attackrange.localNULL SID--0x0ATTACKRANGE\AdministratorAdministratorATTACKRANGE.LOCAL0xd16f33KerberosKerberos-{DDB52289-D3AB-C7BE-A266-64A7568433F6}--00x0-fe80::b1d0:27e2:167d:290e49905%%1833---%%18430x0%%1842 4624201254400x80200000000000008425860Securityar-win-dc.attackrange.localNULL SID--0x0ATTACKRANGE\AdministratorAdministratorATTACKRANGE.LOCAL0xd16f33KerberosKerberos-{7F8B8538-0174-3532-133A-99DE5BD45C6E}--00x0-fe80::b1d0:27e2:167d:290e49769%%1833---%%18430x0%%1842 4624201254400x80200000000000007655140Securityar-win-dc.attackrange.localNULL SID--0x0ATTACKRANGE\AdministratorAdministratorATTACKRANGE.LOCAL0xd16f33KerberosKerberos-{7F8B8538-0174-3532-133A-99DE5BD45C6E}--00x0-fe80::b1d0:27e2:167d:290e53347%%1833---%%18430x0%%1842 4624201254400x80200000000000005935316Securityar-win-dc.attackrange.localNULL SID--0x0ATTACKRANGE\AdministratorAdministratorATTACKRANGE.LOCAL0xd16f33KerberosKerberos-{7EC795C0-C70C-06F8-BB16-FCE72096EDCF}--00x0-fe80::b1d0:27e2:167d:290e53155%%1833---%%18430x0%%1842 4624201254400x80200000000000005741161Securityar-win-dc.attackrange.localNULL SID--0x0ATTACKRANGE\AdministratorAdministratorATTACKRANGE.LOCAL0xd16f33KerberosKerberos-{399F706B-2929-331B-A59F-5EBA379FF45F}--00x0-fe80::b1d0:27e2:167d:290e52851%%1833---%%18430x0%%1842 5136001408100x80200000000000004847183Securityar-win-dc.attackrange.local{366C2F67-4795-4D74-883A-A5F84EAE1794}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x303c7baattackrange.local%%14676CN=unrpiv,CN=Users,DC=attackrange,DC=local{EEB5AA3C-3F52-4C7A-A3A4-9B41A343B73B}usermsDS-KeyCredentialLink2.5.5.7B:828:%%14672:CN=unrpiv,CN=Users,DC=attackrange,DC=local%%14674 4624201254400x80200000000000004847169Securityar-win-dc.attackrange.localNULL SID--0x0ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x303c7ba3NtLmSsp NTLMkali{00000000-0000-0000-0000-000000000000}-NTLM V200x0-10.0.1.3052525%%1833---%%18430x0%%1842 5136001408100x80200000000000004843209Securityar-win-dc.attackrange.local{CE70492C-C1FE-4D79-967F-1D4929F4B40B}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0xd16f3attackrange.local%%14676CN=AR-WIN-2,CN=Computers,DC=attackrange,DC=local{39FBE572-923C-472F-8EF3-9E77FA733751}computermsDS-AllowedToDelegateTo2.5.5.12ar-win-dc%%14674 5136001408100x80200000000000004843207Securityar-win-dc.attackrange.local{CE70492C-C1FE-4D79-967F-1D4929F4B40B}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0xd16f3attackrange.local%%14676CN=AR-WIN-2,CN=Computers,DC=attackrange,DC=local{39FBE572-923C-472F-8EF3-9E77FA733751}computermsTSInitialProgram2.5.5.12bad%%14674 5136001408100x80200000000000004843206Securityar-win-dc.attackrange.local{CE70492C-C1FE-4D79-967F-1D4929F4B40B}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0xd16f3attackrange.local%%14676CN=AR-WIN-2,CN=Computers,DC=attackrange,DC=local{39FBE572-923C-472F-8EF3-9E77FA733751}computerscriptPath2.5.5.12C:\temp\bad.exe%%14674 5136001408100x80200000000000004843174Securityar-win-dc.attackrange.local{689B19C9-01AA-43A1-8900-0B3A2FC806E6}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0xd16f3attackrange.local%%14676CN=AR-WIN-2,CN=Computers,DC=attackrange,DC=local{39FBE572-923C-472F-8EF3-9E77FA733751}computermsDS-AllowedToDelegateTo2.5.5.12ar-win-dc%%14674 5136001408100x80200000000000004843172Securityar-win-dc.attackrange.local{689B19C9-01AA-43A1-8900-0B3A2FC806E6}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0xd16f3attackrange.local%%14676CN=AR-WIN-2,CN=Computers,DC=attackrange,DC=local{39FBE572-923C-472F-8EF3-9E77FA733751}computerscriptPath2.5.5.12C:\temp\bad.exe%%14674 5136001408100x80200000000000004842590Securityar-win-dc.attackrange.local{10C82668-B3B7-4A8D-A453-74D5A9EF910E}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0xd16f3attackrange.local%%14676CN=AR-WIN-2,CN=Computers,DC=attackrange,DC=local{39FBE572-923C-472F-8EF3-9E77FA733751}computermsDS-AllowedToDelegateTo2.5.5.12ar-win-dc%%14674 4624201254400x80200000000000004487305Securityar-win-dc.attackrange.localS-1-0-0--0x0S-1-5-21-390003789-444691441-1275789787-500AdministratorATTACKRANGE.LOCAL0xd16f33KerberosKerberos-{588075C0-855F-0FC7-9682-77CBB4E6E6DD}--00x0-fe80::b1d0:27e2:167d:290e50684%%1833---%%18430x0%%1842 4624201254400x80200000000000004452796Securityar-win-dc.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-DC$ATTACKRANGE0x3e7ATTACKRANGE\AdministratorAdministratorATTACKRANGE0xd16f310User32 NegotiateAR-WIN-DC{1BC612F5-ED09-CC37-DFEB-C69076A3B170}--00x4e0C:\Windows\System32\svchost.exe101.182.196.1630%%1833%%1843--%%18430x0%%1842