23542300x800000000000000031776Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:18.893{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=209378FD58852CBF9485D2FFB83795BC,SHA256=DBA7E3F247DACC9B30819F1AF42F0F978D8D4FC6ACB49DA363EE1980E505B969,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071824Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:18.376{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2E5B7015AE1E2045BCE55289094E2BFB,SHA256=DBA88713678B785E84A2A8E002601C80CE16B116027D34680CC4097C54178E6A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071823Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:18.160{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=11B16D92F360FF8DBB6463B989C9499C,SHA256=4821E28EE09ACC63FEEDA72064390C4747FC97999FFDD204EC8008CBA0024EFB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071822Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:18.144{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=32E1D7CD54A93C827B225C2E010CF835,SHA256=DC6D087AE4598A98A2DEC25BFCE96018CE53C7996610D881AAE5814C9D627481,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071821Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:18.144{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=FC74E6DB6527EADF16A76C3117B58433,SHA256=D1719D1CE960607776A9EFA45AD918670B55B087FC31F963C3301991B8749853,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071820Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:18.144{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=A1F375806E5F94786AC01D63669FE518,SHA256=6C1FA56BBD774878379D365BECC88A356BA2FD35AEED6003D23D398E90A29E0B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071819Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:18.144{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=B887A7E94D4385D5EF2190F61234896E,SHA256=BE8F8DC7FC0CAFDBC60AAFBE15984F05F3023F7085662D89053580F11834EF16,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071818Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:18.144{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=E1FF56872FD69D8145853F299BD91C08,SHA256=ADDFF57FE000D14EB33E9BFAFAFE2943DEE54638350A533E9741B73D43C55420,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071817Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:18.144{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=7C96E76095353630BCE04450C12F9A04,SHA256=1601F45DA83F6D7992B945C7450858F6FF48E0617F1B24AD3784C39BE1DB1E99,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071816Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:18.144{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=5F81D05A0E462D3B71A057FB87C65481,SHA256=24D1132DB17ABDEB23AF2130C903B2278F26C2F22DC59FFBD5CD787CF5823539,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071815Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:18.144{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=015175BF0AE0DC9928A73FC9C18EFE65,SHA256=6A0DC09CAB70E27100624F72A61AB82B3592957F5715938FCFA4A29D95FDCA51,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071814Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:18.144{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=7D38FE4A426B89D3F2E9485B51CBD2EC,SHA256=C43AEC6288C65D416C1F1355FFE278A5D41866C1F8C43BC2E4A325E1F68B064B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071813Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:18.144{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=B643405C2B0B8BD6610DA163B7480572,SHA256=F323F73E559AB0B9304BE800737EDA60EDC2FF901E8BAF63454D6F568EB49398,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031777Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:19.893{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DA4D5379ECABD5C61AC61B89E59899C9,SHA256=109EA1119B2CDF3BA89ED9AA32D3D6AEFA09332B5FEC2F0BD0FF907FA319EE2F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071825Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:19.376{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DCBCE2304A3F309E1C188DF9DB0A4D7F,SHA256=888B269C9E519EE60E6151F34DCBE36F1398042852A826AF436FA50D0913658A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031778Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:20.908{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A7BBEBDEBF21D7FB49E55834C75922CF,SHA256=4D88F975668813CD50080E7DB759750F7B1D8C040D709EEE03478657F87A7880,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071826Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:20.391{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D656CE3D849AAF93F108BCC81C7B64CB,SHA256=37D7A774015C1863CBEEA0095E258E7E12325F766B973EDF8C9A5CAC20FD02A4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031779Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:21.924{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=978CEB5BDBF8E0FC84F385BD9ABE9759,SHA256=CC314163E20474D751CB797F39CDA3F4899A386CD2D1A9D712EFEE8F31A53F47,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000071830Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:21.946{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000071829Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:21.660{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000071828Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:21.591{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000071827Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:21.407{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5EC2A3F483376AFEEA98B41F4244A842,SHA256=873C92EEEB39B15A1A42BC0326EC83E2C59DE2976D3E34E74DAC523324E68299,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031780Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:22.940{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2DD3F29CC644DE9EBF337A489F855C95,SHA256=3D859D7F84FCD3E749E92E2011900179A40F5AB061B884A353D5664F8EA6F697,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071833Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:22.990{8057F119-08A1-60EC-1100-00000000DB01}108NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=AC11FDE6EA005B43532EDC616FD59B3A,SHA256=191A96BE796F1CD703CBF4D428293E7A7F8538069CEE694E6D3696D83A2CCDC5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071832Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:22.426{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8F696CFC7F9E70CE86CE79E10B26930A,SHA256=3994E9FAFA20308E551E3578E1FF5244503D210FC862EFB99F4030E4076D6ACB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000071831Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:22.375{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000031796Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:23.955{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9DA15A1F01B6E67D423A16F2B93FC269,SHA256=13D621DA9BD91E839E5712E5D201D41E9610A6965917BFFAD53CC54C59E35EEB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000071839Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:23.861{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000071838Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:23.528{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000071837Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:23.442{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000071836Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:23.442{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7DD12CD2FA81FBE09EA8D34A6E5D9DD0,SHA256=7B555AB1B7D3CF473DA544A46D2F54A48BDC1D1F59B2F08C3219D4F011B39A14,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000031795Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:23.565{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F13-60EC-1A05-00000000DC01}792C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031794Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:23.565{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031793Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:23.565{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031792Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:23.565{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031791Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:23.565{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031790Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:23.565{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031789Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:23.565{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031788Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:23.565{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031787Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:23.565{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031786Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:23.565{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031785Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:23.565{50946567-0A80-60EC-0500-00000000DC01}416532C:\Windows\system32\csrss.exe{50946567-2F13-60EC-1A05-00000000DC01}792C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000031784Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:23.565{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F13-60EC-1A05-00000000DC01}792C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000031783Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:23.566{50946567-2F13-60EC-1A05-00000000DC01}792C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000031782Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:23.361{50946567-0A81-60EC-1100-00000000DC01}972NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=B56470119A3A90506EF556F855A7F787,SHA256=207D389DED0EADDE9461D0D40D119ABCF3DDCD3BC1FAF9BC1D1C392A95EEB4E2,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000031781Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:20.388{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51546-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000071835Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:23.358{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000071834Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:21.295{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63275-false10.0.1.12-8000- 23542300x800000000000000031827Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.986{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8DBBD611F07E0E95A397A639085616CA,SHA256=E03FA98E937CFF940D726BDA76571532DF9BA5788AFA1FBA72CDF3756017724E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071841Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:24.991{8057F119-08AE-60EC-2D00-00000000DB01}3004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=A52F6585761A8E82F695C029A0DE8E39,SHA256=23013549159043F148E7F54E2980270BD42A6AB4C4FA368424ACDA42C74194F9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071840Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:24.445{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A672DC045C8E80005FCD23CF38E353E3,SHA256=9A95871D249E19954B9CE70AAC2D10EFDCF7BE4CB2E532C54F2946A3612F11CF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000031826Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.830{50946567-2F14-60EC-1C05-00000000DC01}26003616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031825Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.643{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F14-60EC-1C05-00000000DC01}2600C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031824Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.643{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031823Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.643{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031822Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.643{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031821Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.643{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031820Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.643{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031819Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.643{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031818Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.643{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031817Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.643{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031816Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.643{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031815Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.643{50946567-0A80-60EC-0500-00000000DC01}4161044C:\Windows\system32\csrss.exe{50946567-2F14-60EC-1C05-00000000DC01}2600C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000031814Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.643{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F14-60EC-1C05-00000000DC01}2600C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000031813Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.644{50946567-2F14-60EC-1C05-00000000DC01}2600C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000031812Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.580{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9414F83788BF748BE35C812B101FBCA6,SHA256=D2FA9FDBEBB436735F917B74E4E07D0F9D19926C71D9F67C0CC81C9C770104E9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031811Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.580{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6ABC32092F12489342D957DC4CF8D806,SHA256=8652ED217877CFB4BA9BAC485F1163CB7940DA57FA2360F407B0DA3BC9A7A199,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000031810Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.377{50946567-2F14-60EC-1B05-00000000DC01}19243296C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031809Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.143{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F14-60EC-1B05-00000000DC01}1924C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031808Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.143{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031807Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.143{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031806Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.143{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031805Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.143{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031804Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.143{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031803Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.143{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031802Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.143{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031801Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.143{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031800Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.143{50946567-0A80-60EC-0500-00000000DC01}416532C:\Windows\system32\csrss.exe{50946567-2F14-60EC-1B05-00000000DC01}1924C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000031799Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.143{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031798Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.143{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F14-60EC-1B05-00000000DC01}1924C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000031797Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:24.144{50946567-2F14-60EC-1B05-00000000DC01}1924C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000071843Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:25.475{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1E994F90F558C9ABA8D9CE05B215BC33,SHA256=F2C9DB7487A6DA1772EF519B7C126F2EF5E1965B184FC9B969351B8A1D979A41,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000031855Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.971{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F15-60EC-1E05-00000000DC01}1056C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031854Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.971{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031853Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.971{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031852Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.971{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031851Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.971{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031850Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.971{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031849Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.971{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031848Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.971{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031847Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.971{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031846Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.971{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031845Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.971{50946567-0A80-60EC-0500-00000000DC01}4161044C:\Windows\system32\csrss.exe{50946567-2F15-60EC-1E05-00000000DC01}1056C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000031844Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.971{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F15-60EC-1E05-00000000DC01}1056C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000031843Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.971{50946567-2F15-60EC-1E05-00000000DC01}1056C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000031842Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.799{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9414F83788BF748BE35C812B101FBCA6,SHA256=D2FA9FDBEBB436735F917B74E4E07D0F9D19926C71D9F67C0CC81C9C770104E9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000031841Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.486{50946567-2F15-60EC-1D05-00000000DC01}14521128C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031840Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.315{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F15-60EC-1D05-00000000DC01}1452C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031839Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.315{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031838Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.315{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031837Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.315{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031836Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.315{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031835Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.315{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031834Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.315{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031833Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.315{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031832Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.315{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031831Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.315{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031830Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.315{50946567-0A80-60EC-0500-00000000DC01}416432C:\Windows\system32\csrss.exe{50946567-2F15-60EC-1D05-00000000DC01}1452C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000031829Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.315{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F15-60EC-1D05-00000000DC01}1452C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000031828Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:25.315{50946567-2F15-60EC-1D05-00000000DC01}1452C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000071842Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:25.191{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000071844Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:26.490{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=82AFDB3EAAA4410321683ADADC8877B5,SHA256=6300EF75298CCE757B001CC03F57ECC7F9D1125A99946A08ABF5E56CFD955342,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031857Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:26.971{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B4C580C06BB8ABCBF0765884249C64B3,SHA256=0AE037BCCF65B46DB79EF8B1AEBE503A9A055FE487A9BE5D723886DE4957F279,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031856Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:26.143{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=055947FC70504FD243A7959DE12FCAE3,SHA256=D6E0205AAE3DC13B4F3A9A0F42B3A9E6AD0D2A0EE324E287B486263D4E43D19C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071846Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:27.505{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE3B45F90B95DB39708EC0D87C350B71,SHA256=C2993185BEC8F27D7F7ED07291C42D88ED909C3B4F675A76AE448CCD583D5582,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031858Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:27.377{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AF197E1833292D82E963332B4FA09620,SHA256=EABECE6AE3A4F8239481F4AF291C2D585DBFFC08922130929DC098E1CCDC8F54,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000071845Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:25.111{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63276-false10.0.1.12-8089- 23542300x800000000000000071847Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:28.523{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF7AEDEC455BD56ED361CDB8A2C7951C,SHA256=5306C30FBC45F4D1C92AEE46BDD261405B8B430CC8A04070A9296DE9D755A03D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000031887Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.908{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F18-60EC-2005-00000000DC01}1572C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031886Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.908{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031885Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.908{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031884Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.908{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031883Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.908{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031882Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.908{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031881Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.908{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031880Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.908{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031879Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.908{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031878Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.908{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031877Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.908{50946567-0A80-60EC-0500-00000000DC01}416532C:\Windows\system32\csrss.exe{50946567-2F18-60EC-2005-00000000DC01}1572C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000031876Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.908{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F18-60EC-2005-00000000DC01}1572C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000031875Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.909{50946567-2F18-60EC-2005-00000000DC01}1572C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000031874Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.408{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=057FE951608A36C299590ED14F201963,SHA256=9C537938BAF6DA41DB8D7CB2F2F4EE77D178A390FC7D4EBB64AB8E381973CDDD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031873Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.408{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2AC673D5A87783ED315F85F031B06B0B,SHA256=8CBD9FB0BB4AEB651B083269E7DD71D50CB8A057F7489D145F89FACAB46D5DD3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000031872Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:26.388{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51547-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000031871Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.236{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F18-60EC-1F05-00000000DC01}1812C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031870Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.236{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031869Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.236{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031868Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.236{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031867Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.236{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031866Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.236{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031865Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.236{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031864Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.236{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031863Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.236{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031862Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.236{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031861Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.236{50946567-0A80-60EC-0500-00000000DC01}416432C:\Windows\system32\csrss.exe{50946567-2F18-60EC-1F05-00000000DC01}1812C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000031860Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.236{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F18-60EC-1F05-00000000DC01}1812C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000031859Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:28.237{50946567-2F18-60EC-1F05-00000000DC01}1812C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000031890Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:29.455{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A68562BA8B2E8CD99D63BD1745FA84B4,SHA256=0CE0C156ECC9955987C0563E676F0AACD370A938E0E8A1F969F7751C0D89EB98,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031889Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:29.455{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A1363D31C57EF2570924BFA1D237BE1E,SHA256=102A66ADAFEA62914ACB810349A0FE8BC29444B7E143B8CEE3982EFB150B79B5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000071850Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:29.541{8057F119-089F-60EC-0B00-00000000DB01}6324048C:\Windows\system32\lsass.exe{8057F119-089C-60EC-0100-00000000DB01}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96ef2|C:\Windows\system32\kerberos.DLL+793e4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2d231|C:\Windows\system32\lsasrv.dll+2b3f4|C:\Windows\system32\lsasrv.dll+30949|C:\Windows\system32\lsasrv.dll+2e2a7|C:\Windows\system32\lsasrv.dll+2d231|C:\Windows\system32\lsasrv.dll+15e0d|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 23542300x800000000000000071849Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:29.541{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F906AE7683AA29CB56DD42CF5DC30FA4,SHA256=1B381607B028F4AEC9D6257F513858AC19D49CF86162A9FD51BD215EE184E76D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000071848Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:27.256{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63277-false10.0.1.12-8000- 10341000x800000000000000031888Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:29.096{50946567-2F18-60EC-2005-00000000DC01}15723592C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000031891Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:30.489{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=36904341D151F46AB1BAE7FA124CCB0E,SHA256=BBDB7679AD2CB39201A6D2CC23F7F6697287B377132A44974AB24BF5F607A254,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071853Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:30.557{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=03F2086A38203205D12AEAAC04EB1635,SHA256=F607E29763D3B54850F077461CB545A966A84741925C3D6B37BD0F0A4A8E59F8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071852Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:30.557{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4F9A29B8C469C130E351FD66C5BA8313,SHA256=AC01EBCF1637C252A35DF05D78E641CC0147BC2D4A1A513FCECBFF5F80DE83C5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071851Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:30.557{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8AE4D49AAD2768E36166BCAE550C2E3F,SHA256=6DF21335E29D495DCA674EB1FD0814CAFFD6DC42C8923533B77D1C4232BE2563,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071867Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:31.587{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=55DB21952243A461926C06B93A19D37B,SHA256=4F2E2904935A0C69C25758554075B1013A864D011AA1FACEC7C56A5BE02A619F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031892Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:31.533{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E5B08DAFD85B9D7AF7B33D3CA41CBDF,SHA256=1175892B1B0F456826FA870A7FD54391C17BD53FA3FC43C1C9E113862A9AA923,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071866Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:31.371{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=E54F3FA08479C7D21518F9A45CF3E5BF,SHA256=9EC3DE08B42954B1FC880AA20593B27C107FDD4EE262D3887A42D8AE460BEDDB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071865Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:31.371{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=B92EC1D5823FA1C731C3DDD7F29D51E6,SHA256=18DBB3CFFA7875FB1BAE9EF00BBAAFB3866639C138C98458188C1F1D5C198656,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071864Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:31.371{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=AB481FA45367F14434B84D725B052DFE,SHA256=7E599A5CA12FC1A5147AABD51CAC9D646BB31CD049D0AAE5D3053D1B13784D24,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071863Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:31.356{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=F7C9540EE6A691A344AEE0170B258A01,SHA256=8E93375D4AD1E45D17D3024A384FEE8C1751342D325D067282A4E2A5C8980879,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071862Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:31.356{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=5EEAEE255AD2875B25CF16610A92094A,SHA256=66C7A5A4DFBEFB61734FEBA22226D4BB4EC50BBC738A3334F270886921FEF9DA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071861Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:31.356{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=42D8F8A7FA4B1914182F02AE356302FB,SHA256=81A6F74C89E3B1751B4C859ED8D56CDDA02FD04F2D324DBF400CB80E129218A2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071860Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:31.356{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=33826FE6FDAAA27199507B3EC37FCDED,SHA256=14A461306B1053E51B61211CC25BD6F19D6581B3EF8C550AE70249AC1F783AA6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071859Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:31.356{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=8A1B0AED9235197516637632A12249B4,SHA256=428DFD5AFC34658ED6E896A41F8BB9D56A9654EA0AF585B46BD26731A9A0EB8C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071858Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:31.356{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=29CA061B84648017E248B89578ABBB10,SHA256=293DE97EEAF9EAB3EF63BD5CAD610A549CDF75AC6B165BC877ED50211CBA3A6E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071857Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:31.356{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=AAC5D602C4BC56C51E6F9BA3F0262308,SHA256=36416520A502B1163D8513B6A7BF5572096FE6E46E68D8BE08C38BF1C91A14BE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071856Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:31.356{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=A3A4562927D46DCC95869E199F305F98,SHA256=246CDCEA081CC13330B92511A0C352D9785DD543FFCCC0A4A51D546FE19D073A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000071855Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:29.678{8057F119-089C-60EC-0100-00000000DB01}4SystemNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63278-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local445microsoft-ds 354300x800000000000000071854Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:29.677{8057F119-089C-60EC-0100-00000000DB01}4SystemNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63278-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local445microsoft-ds 23542300x800000000000000071868Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:32.603{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=34F2CEDDBB724DACAB15A564298545E2,SHA256=3A66658326BEBE652CE4722C304A070833FF582716588117166E45E4473CC9B0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031893Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:32.565{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E6A6324949E39F254CC25E24CBD64319,SHA256=8A51326B5971368D5669B0369D110191E70A30F5C506E28E8707E1E6C1C4690D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031894Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:33.585{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=716CBF8504D72738B04F378CD108B472,SHA256=FE1F3DDB6EDA718C216080454857A12A3C4B8E256203B1A8D95FBD41B77482C4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071869Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:33.603{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7A9D940DE6FE23A698D7B6E37E50D5CA,SHA256=4022F93BB078E53CC72479C3554292533D44525AD718E1098FE04747A44D11E9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031896Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:34.679{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D41144F5EEDEC2FD495DF0CF3A183F2A,SHA256=EC3B65D5512DB23087066BC561BC6ABD82D0E523AAAE131C3FFD313B8A9367AD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071870Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:34.620{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2A2C5185E282130D525696D1672E22FD,SHA256=09BB6E20CD1D7CB9C4A5701432F1C0ECBBE3DE196A76DAA68DD5036E49FB59E7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000031895Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:31.514{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51548-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000031897Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:35.741{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BB075146B732DF61989BC311DFBC3CAC,SHA256=EA8AC3A9A4B9B844AF91266C1CB4FDAC9829D560487CD960BC97823DE4E7E7BC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071872Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:35.638{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=454AA9A0AB2E4C39557DE181905E023A,SHA256=4856D220A6F2AB368ABECE2F775B82FBB8861ADC44B89D8A161D006437BAE2C8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000071871Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:33.275{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63279-false10.0.1.12-8000- 23542300x800000000000000031898Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:36.976{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=81BAC5B96D7D06FF4EF7F6569EADDA48,SHA256=57C02F26CCD8716F92540A6E1540BA85321FBE8015F5EC33FFD39CFD74325F52,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071873Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:36.653{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=032743A29C3C6BB3A3CDCBACE923129A,SHA256=D492F0407F2222240262C55E2F282AFCED7199027334224CC6958AB333ABD18A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031899Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:37.991{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DFBDC0011C9C9D4311087BA58B89D59C,SHA256=203F63006192E99BF598F422BDA8908C8ECCCB3FDB2EDFD3B2B49FFBEFE8972C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071874Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:37.668{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BA44F2A83AAA48DAC67CE3D1334D0A56,SHA256=3C56EB21C77A9441D071BB280BC5A33EDFAF7C9D45242D0B2B7B8007A191E802,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071875Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:38.698{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CA464F46292AC83DE93DBFA855E7A7D6,SHA256=9EDFF7492D67BEE533CFBD85AC193B5EE367CAC3395953D030E51FBCABF59F84,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071876Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:39.715{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EBFD4FE9660A95EC2B58A7D10637B211,SHA256=38B7C904E78C27A5B67171D325DA16D3813030A3549DE407C7C17FC2593AD2D3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000031901Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:36.533{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51549-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000031900Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:39.116{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CD0C2B5465930B47A9C2D0E29808AEED,SHA256=7CDDFCA970769F783DAE1F0161648151010000E3323F839386AB8CCC4CCB58E1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071880Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:40.733{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8D171E7F0BC6DA07A29EA45557767F31,SHA256=51235903BA431A0979E3C4284B8F083D55FBB95DDFF6A7BE42E25C52A53EB3E1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031902Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:40.351{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D257D8419966448B60E40E251268200A,SHA256=3359302A96AE264961360BDFECBC5D086374D35F8702EF4BF61FF83D79348EA0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000071879Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:40.596{8057F119-08A1-60EC-0D00-00000000DB01}8968572C:\Windows\system32\svchost.exe{8057F119-1972-60EC-F605-00000000DB01}3272C:\Windows\System32\rdpclip.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000071878Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:40.596{8057F119-08A1-60EC-0D00-00000000DB01}8968572C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4207-00000000DB01}5712C:\Windows\System32\rdpclip.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000071877Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:39.217{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63280-false10.0.1.12-8000- 10341000x800000000000000071886Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:41.848{8057F119-08A1-60EC-0D00-00000000DB01}8968572C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2F00-00000000DB01}3068C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000071885Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:41.848{8057F119-08A1-60EC-0D00-00000000DB01}8968572C:\Windows\system32\svchost.exe{8057F119-08A1-60EC-1600-00000000DB01}1236C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000071884Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:41.848{8057F119-08A1-60EC-0D00-00000000DB01}8968572C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2F00-00000000DB01}3068C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000071883Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:41.748{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=040A7016771E28EDDB6795A205591EF9,SHA256=6FF03D3FBB2304064A05A497698C3A9A38390153DBA7134036390E2AD18CBC94,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031903Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:41.585{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF8563BB58742DB6373FA060F31056F1,SHA256=4AE4B692AAE18F542CE7BAA08CBDFEA3F9839EAEE20B56F474E43AECCB510763,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071882Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:41.264{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4194DEFF88AD20A6900B941AFE8CE30C,SHA256=C5EE6050C9B8C532DBC1C7A224DE31FBC8AAFB5EE3E94644E756B2D5A94D9B3D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071881Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:41.264{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=03F2086A38203205D12AEAAC04EB1635,SHA256=F607E29763D3B54850F077461CB545A966A84741925C3D6B37BD0F0A4A8E59F8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071887Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:42.764{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9967EE8412654E80203474C4E5826576,SHA256=053B89115B28BB0676D4272913A5E9E3BAA4CA6B7EAA7DF6C1ACDCCF9C1594A0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031904Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:42.679{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=560E819F20E9D0BD1C0A00C8C7E0E69A,SHA256=682D719EBD01F4C5A6F1934E6662EBD696B26D4FBC08FA8DD6F17EDD97B8DD1C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071888Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:43.765{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=738366310551F7962D2F3EE73F30BFAC,SHA256=DAB5D68A6D63C4D1BD56A769FDDDDB3F70247ADA611311C5D64B911C48926ECE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031905Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:43.741{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1F699A3C8714B753B1235D989BB1ADB8,SHA256=F2A88265844D2E32FF1E001297D15D3D665E4744EF8074B305BD3250C59B387B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071889Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:44.779{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AC0A8B85086CC04817960BFDFC08E615,SHA256=656FDC1737E0C6871CD4A4A56969B2FCC468C3C6672419CF8ED3E90C2F155ABF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031906Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:44.757{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7D15317BBD28617F646ED574BA782AD1,SHA256=B7292C63FF926BCE979C4DEC5E12C4090E836FF6B6B62DCEC9ED7DA16974E214,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071901Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:45.795{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A15C4CC5F461DFA41F33D4BAD771293F,SHA256=3A07F505138D17C4AC39D58CE87AE996F7CDD9CFDBC8569DD431A079ECC20B24,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000031908Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:42.580{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51550-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000031907Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:45.772{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7900CCBB8B0DF7BA0B2A09947D937B54,SHA256=D4C571F5A3AB4AFE1CF25D479281648EA056E7533FFDDA8FD67280965FA6AD78,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071900Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:45.116{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=55B51A9C74EA2D52382CB4D9F1502505,SHA256=B5451100AFDFECC65DD73439C08C2F15271FFF7644655B5D216CF2E2F86B4084,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071899Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:45.116{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=72725AD534C9D8D88D96F26C1EBBCCD7,SHA256=A361F38FDB2145DB0E035E8B2131DB9437BD8E2B8E9ABF365C7E473EEF622895,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071898Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:45.116{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=60A508CD7517D685AEBE038C93147F06,SHA256=3CC22B348C47F1EAC35A70D15534DC794028E9EFDB11F414B816D0F2ACAA4B01,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071897Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:45.116{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=5846791359B9C79785F9F5773DA0FE4A,SHA256=1B952FBE9FF5763179B7D4A17C9CBB57B5EE48AE4F08C809028EBE9D23975EB3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071896Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:45.116{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=AC5E0FC97622131647E9B00FE866F731,SHA256=499CCB71B46ADE69E87EC647F6AFC03CE051CD9D1F9A3A04FCEEA38B6C55D799,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071895Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:45.116{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=146A52E79ED7353D438E980F836B94D7,SHA256=37950F64DE5217F094D67B851C3D36135F393F78ECCD09112B276B982341082E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071894Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:45.116{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=F49EAF16720CB57D94F7727C5BF4342F,SHA256=72531DF3812EC38FB5387B3E5EA7F8526B36C5F89C63DE8BB8B6F28120F9765A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071893Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:45.116{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=C534985CBE203FAEC7879E3335C22DB3,SHA256=E23C54219CE74362C5FAD192903DB3654F5E6D379F4BF3A1232DF863852F575A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071892Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:45.114{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=E6F74560705F8471CCA5BAC643F27E3D,SHA256=0612BFB8A184456AAAB99804BF245F573A4EFA1F58DA5DDE5A7A10402F0CB27D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071891Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:45.113{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=63481355A76CD1683935CB471EDAE146,SHA256=CE5E54C9577409CC4D743024CEC5D1A4F330B70918217C1E1846A0A18F311CAE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000071890Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:45.112{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\datareporting\glean\db\data.safe.binMD5=B18A2440AB4D1FE5FDEA1D37ECBD416D,SHA256=F50D25F73F6D5482ED1036930CC413852E1420EA1F81484BF2A6016FC1140210,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072007Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.965{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B577159B11884819BBBE021911D23CFA,SHA256=0095BD47B71921BF4C7FFE12FEE10AF1B3646B32D5C08D79FE6B5E1D020D078B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072006Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.918{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9A46E28FD5237D3BE61936F3DCBB3BC1,SHA256=F2909FADBA3ED07E5D2BD10B5EF6C7C2653FF955F578B8310184FE062FBB6D82,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031909Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:46.788{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A2B90D7FE22DBE48A6C133469E6DEEF5,SHA256=883BE5549E5AEAB26C785A39AFA21FE1C2396E57DE3EE87F02776AD6C71C3EBF,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000072005Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.750{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000072004Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.750{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000072003Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.750{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000072002Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.734{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000072001Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.734{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000072000Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.734{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000071999Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.734{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000071998Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.734{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000071997Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.734{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000071996Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.734{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000071995Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.734{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000071994Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000071993Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000071992Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000071991Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000071990Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000071989Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000071988Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000071987Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000071986Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000071985Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000071984Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000071983Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000071982Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000071981Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000071980Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000071979Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000071978Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000071977Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000071976Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000071975Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000071974Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000071973Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000071972Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000071971Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000071970Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000071969Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000071968Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000071967Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000071966Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x800000000000000071965Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000071964Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000071963Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.718{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000071962Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.717{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000071961Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.717{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 10341000x800000000000000071960Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.716{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000071959Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.716{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000071958Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.716{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000071957Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.716{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000071956Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.716{8057F119-089E-60EC-0500-00000000DB01}412528C:\Windows\system32\csrss.exe{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000071955Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.715{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000071954Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.714{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000071953Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:45.246{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63281-false10.0.1.12-8000- 10341000x800000000000000071952Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.349{8057F119-2F2A-60EC-E709-00000000DB01}83089964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000071951Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.349{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000071950Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.349{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000071949Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.048{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000071948Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.048{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000071947Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.048{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000071946Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.048{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000071945Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.048{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000071944Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.048{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000071943Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.048{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000071942Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.048{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000071941Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.048{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000071940Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.048{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000071939Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.048{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000071938Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.048{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000071937Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.048{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000071936Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.048{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000071935Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.048{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000071934Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.048{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000071933Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000071932Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000071931Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000071930Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000071929Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000071928Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000071927Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000071926Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000071925Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000071924Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000071923Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000071922Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000071921Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000071920Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000071919Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000071918Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000071917Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000071916Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000071915Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000071914Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000071913Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000071912Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000071911Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000071910Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000071909Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000071908Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000071907Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000071906Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000071905Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000071904Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-089E-60EC-0500-00000000DB01}412528C:\Windows\system32\csrss.exe{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000071903Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.033{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000071902Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:46.034{8057F119-2F2A-60EC-E709-00000000DB01}8308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000072063Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.596{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000072062Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.596{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000072061Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.596{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000072060Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.415{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000072059Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.413{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000072058Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.413{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000072057Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.396{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000072056Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.396{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000072055Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.396{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000072054Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.396{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000072053Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.396{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000072052Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.396{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000072051Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.396{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000072050Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.396{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000072049Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.396{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000072048Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.396{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000072047Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.396{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000072046Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.396{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000072045Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.396{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000072044Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000072043Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000072042Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000072041Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000072040Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000072039Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000072038Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000072037Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000072036Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000072035Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000072034Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000072033Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000072032Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000072031Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000072030Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000072029Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000072028Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000072027Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000072026Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000072025Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000072024Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000072023Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000072022Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000072021Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000072020Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 10341000x800000000000000072019Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072018Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072017Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072016Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072015Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-089E-60EC-0500-00000000DB01}412528C:\Windows\system32\csrss.exe{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000072014Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.381{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000072013Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.382{8057F119-2F2B-60EC-E909-00000000DB01}988C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000072012Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.035{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=BC0A16C493AD6D2A9123D9B012B5E1E2,SHA256=B15846A5608B813C47E416122B6BD9398C148B09F50288C8E47837E0E05596DA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072011Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.035{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4194DEFF88AD20A6900B941AFE8CE30C,SHA256=C5EE6050C9B8C532DBC1C7A224DE31FBC8AAFB5EE3E94644E756B2D5A94D9B3D,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000072010Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.018{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000072009Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.018{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000072008Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:47.018{8057F119-2F2A-60EC-E809-00000000DB01}7200C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000072065Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:48.415{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=BC0A16C493AD6D2A9123D9B012B5E1E2,SHA256=B15846A5608B813C47E416122B6BD9398C148B09F50288C8E47837E0E05596DA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072064Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:48.164{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FE564749D9D8EF7C84829CECCAE8A230,SHA256=638E2ED17B4E78BA1651AE0433E646CDE74A86D94A83AE39D10FC2FA478F1639,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031910Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:48.007{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C2ECC69B6BBAD3D81292C1C68EDC6D55,SHA256=A80338541B9B164064F4A5B527FCB3234F175F7167D6C645917602A9624FD01E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031911Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:49.085{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=85BC56B2106777C29FDBE810D6F3ABFB,SHA256=BE946FFE125064FCD436E9637B7098FB0CABA694CA659BB9B690CDD7AC251633,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000072117Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.617{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000072116Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.617{8057F119-2F2D-60EC-EA09-00000000DB01}93609796C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000072115Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.617{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000072114Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.617{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000072113Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.380{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000072112Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.380{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000072111Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.380{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000072110Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.380{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000072109Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.380{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000072108Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.380{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000072107Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.380{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000072106Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.380{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000072105Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000072104Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000072103Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000072102Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000072101Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000072100Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000072099Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000072098Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000072097Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000072096Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000072095Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000072094Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000072093Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000072092Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000072091Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000072090Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000072089Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000072088Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000072087Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000072086Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000072085Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000072084Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000072083Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000072082Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000072081Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000072080Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000072079Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000072078Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000072077Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000072076Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000072075Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000072074Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000072073Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072072Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072071Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072070Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072069Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-089E-60EC-0500-00000000DB01}412528C:\Windows\system32\csrss.exe{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000072068Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.364{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000072067Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.365{8057F119-2F2D-60EC-EA09-00000000DB01}9360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000072066Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.180{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=843B9B50979115DC0619212739F6125E,SHA256=62F9249A3A9358227C6BFE83191AB2121C90C29EBA43CC6840C7003674F030D7,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000072223Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.922{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000072222Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.922{8057F119-2F2E-60EC-EC09-00000000DB01}96089776C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000072221Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.922{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000072220Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.921{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000072219Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.717{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000072218Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.717{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000072217Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.716{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000072216Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.715{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000072215Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.714{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000072214Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.714{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000072213Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.713{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000072212Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.713{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000072211Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000072210Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000072209Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000072208Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000072207Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000072206Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000072205Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000072204Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000072203Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000072202Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000072201Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000072200Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000072199Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000072198Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000072197Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000072196Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000072195Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000072194Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000072193Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000072192Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000072191Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000072190Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000072189Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000072188Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000072187Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000072186Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000072185Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000072184Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000072183Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000072182Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000072181Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000072180Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000072179Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072178Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072177Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072176Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072175Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-089E-60EC-0500-00000000DB01}412436C:\Windows\system32\csrss.exe{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000072174Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.695{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000072173Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.696{8057F119-2F2E-60EC-EC09-00000000DB01}9608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000072172Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.379{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E6759F7C812AF96EC75D6EFBECBF057C,SHA256=5B83D19F920DF1FB0D96757C9AA843186D51D52FC39640400F2AF1C875EB8101,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072171Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.279{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C2F2458F334B9E283436F63D8D30447E,SHA256=ADFF241526FB58466AEC8F2691E80099B362DA026DFF5F175657470052D6C01D,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000072170Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.264{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000072169Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.264{8057F119-2F2E-60EC-EB09-00000000DB01}954410164C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000072168Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.264{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000072167Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.264{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000072166Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.248{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A3187C313601951DF2E1DDBDF764941C,SHA256=5E419E122BA95A1FCB2D072EB49631069A4B48EF84F8FB3FAD5702EAEAE5DE57,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031912Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:50.101{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EE509FFED1A545815C7C9AE8B6984FD8,SHA256=F349BAC62721A6AD45CE715B3BE39785D54240E6A87AF2CF932BE8BB90CDF9FE,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000072165Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.047{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000072164Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.047{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000072163Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.047{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000072162Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.047{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000072161Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.047{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000072160Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.047{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000072159Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.047{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000072158Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.047{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000072157Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000072156Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000072155Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000072154Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000072153Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000072152Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000072151Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000072150Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000072149Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000072148Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000072147Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000072146Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000072145Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000072144Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000072143Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000072142Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000072141Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000072140Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000072139Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000072138Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000072137Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000072136Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000072135Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000072134Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000072133Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000072132Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000072131Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000072130Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000072129Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000072128Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000072127Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000072126Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000072125Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 10341000x800000000000000072124Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072123Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072122Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072121Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072120Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-089E-60EC-0500-00000000DB01}412436C:\Windows\system32\csrss.exe{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000072119Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.032{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000072118Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.033{8057F119-2F2E-60EC-EB09-00000000DB01}9544C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000072227Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:51.699{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D1A45C30D1051A185573935EEF55204F,SHA256=175D6D97F3DF19A253A48ADEC58E0A2E8EBFEC64B95EACBC4A8C750EF8FE7C81,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072226Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:51.652{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B49FBFE6A776D522C5A95830F87C5A10,SHA256=5064C50D6FB8DEECE2B105DB17C480848AD4CB42042FF04162340098B237638B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000072225Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.815{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63282-true0:0:0:0:0:0:0:1win-dc-89.attackrange.local389ldap 354300x800000000000000072224Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:49.815{8057F119-08AE-60EC-2800-00000000DB01}2912C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63282-true0:0:0:0:0:0:0:1win-dc-89.attackrange.local389ldap 23542300x800000000000000031914Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:51.288{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=687C2EB2EE052DFE71C8AAE193D3F97A,SHA256=E5D4AC18D008DCBA458147A003F486A0C22FDDEC4E5448FB271AF2F27BE0072F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000031913Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:48.424{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51551-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000072230Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:50.330{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63283-false10.0.1.12-8000- 23542300x800000000000000072229Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:52.567{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CA349E556E4B9A765F0E61F321EABDCD,SHA256=75686A26208931AEE085E475CB3D948446D28C30916A0BC21D4317686ADC0116,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031915Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:52.304{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=04D3241134DFE03D11E050A410E3FBBF,SHA256=9933B8328A111437B5E9A11DF9E02504059050D1448ECFEFD0C4CD491469440D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072228Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:52.351{8057F119-08A1-60EC-0D00-00000000DB01}8968572C:\Windows\system32\svchost.exe{8057F119-08A1-60EC-1600-00000000DB01}1236C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000072282Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.968{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8E9849EB98A2A30A5F7F6642B57AF77E,SHA256=7504C58A30D351DF5CEAF9DDBEC870608AAD82C5F45C96B9F57A062EF12BB052,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031916Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:53.319{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=33C6C030FF1615A227C31B3A1C943AFE,SHA256=F0633EB2D453E6D8E2EA797C2007F4CB319921B274D57929D9D5C2302DA425BE,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000072281Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.369{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000072280Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.369{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000072279Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.369{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000072278Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.152{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000072277Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.152{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000072276Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.152{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000072275Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.152{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000072274Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.152{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000072273Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.152{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000072272Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.152{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000072271Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000072270Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000072269Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000072268Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000072267Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000072266Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000072265Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000072264Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000072263Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000072262Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000072261Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000072260Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000072259Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000072258Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000072257Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000072256Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000072255Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000072254Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000072253Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000072252Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000072251Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000072250Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000072249Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000072248Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000072247Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000072246Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000072245Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000072244Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000072243Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000072242Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.136{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000072241Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.135{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000072240Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.135{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000072239Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.135{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000072238Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.134{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 10341000x800000000000000072237Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.134{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072236Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.134{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072235Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.134{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072234Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.133{8057F119-089E-60EC-0500-00000000DB01}412528C:\Windows\system32\csrss.exe{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000072233Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.133{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072232Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.133{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000072231Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:53.131{8057F119-2F31-60EC-ED09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000072284Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:54.983{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C632C97B536E3250C1910D8B0B25EA4E,SHA256=CE1905162291F57B1C16B63642A42F56E826CA7F3B404B9CEC84502D965BF4B0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031917Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:54.324{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E4901DD1D996C54406E0FF5F8819B51C,SHA256=0CCF6A4ECAF01A1DEF4965CDA4D859C8498F66366210B86EF9F42558B0E477CA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072283Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:54.152{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DAC1DD5E64DD22F89F21240AEF1C9069,SHA256=51905D295EDA91A29A284E9609427C84CEDC994EDD0AFA0F27A5CAC449936573,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031918Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:55.340{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7E07D6F994B956BA020B2E28F2872B22,SHA256=6E0FDF36C366F00E7EC78446EC718787BAC6C20DD73A1622B2C4227340FD2E21,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031920Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:56.355{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F865168E099C5138F30364D349C34EA7,SHA256=3CF593392488838EAF31A179FAC7B947E8DCDAF8DC8811173CEDB199455BCA16,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072286Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:56.597{8057F119-08A1-60EC-0D00-00000000DB01}8965648C:\Windows\system32\svchost.exe{8057F119-08A1-60EC-0C00-00000000DB01}840C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000072285Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:55.998{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4E49FABA64807670E1170AA575188C8F,SHA256=BEEE8FC593957C7ADFA71BE05561A9819084AC388CBCBE7004A8F807B00C2108,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000031919Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:53.444{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51552-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000031921Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:57.371{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D60FD6A643FA629C7A624A3C60978F46,SHA256=17E2DB6274CB6B22F2B676ABF57EFE1FB74658296D102B6CE41C8C4C742DD117,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072287Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:57.013{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6A0FA4C4ADB28D77936B79C948EB51AD,SHA256=B9A567E583D4C815D63467A94A5B2A9E3B6505D731A5E80A60762AFC7EFC4B17,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031922Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:58.371{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C24432B014384046C58F09E8CE8FA167,SHA256=F31B19D12F0669AD23F0A9DBFDB58BC37881A1CFDFE674FDD1C5CF6ECA9C7546,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000072289Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:56.301{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63284-false10.0.1.12-8000- 23542300x800000000000000072288Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:58.033{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CEC4D8D435114A35B2FA0DFF706BF5BD,SHA256=93F20F04A0FBB7EFF1BE8BBE4D5E07F51F9EBB4E3FEBA1D47B1C20D14624141E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031923Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:59.373{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7AA1B39395AB5D8084975CA3071F9DF4,SHA256=61F88D45C01DA0449C2C417DC79A5A6CF3308B969FB1A7A717152E627BD0B18C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072290Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:01:59.035{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=753DB428668C3B4A8908AAAA888ABED9,SHA256=83BF338EB495FBDE3175D8F49E97EB96820D48470506320DCB646DA784FE956A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031924Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:00.386{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=888F533C0868762E8A35D97A3979E646,SHA256=E4FCBAD120486E042CCA32F3EC858CD74CEE0C348F25845F48D71104F45D61C6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072291Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:00.050{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0556A3E147DC0703F712CB44074BB653,SHA256=B3E8A9A70D778E7A4DE1D1FDE5E98F8C14841763C60ADFD6CA720BE7F79EFF4A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072292Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:01.065{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=25885BE3FA88D3FC52EAD52CABF1FD0F,SHA256=EAA77F23BA9C661AE5DE188A51B3489F46493BDE72E053B3BFE6509A2F2A0AD5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031925Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:01.393{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=28C62295C4CB8D78C554DB1A84118F22,SHA256=F1D660C1215803538BDDA243384B0E66B76DB0553AE1FEA8ABC37FC4B135A012,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000031927Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:01:59.446{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51553-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000031926Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:02.403{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=272A6580E11EAD513A20C1A1A738852E,SHA256=3C4233F3FB0084BC3ACE32A032184900C14B090B33DE87619CA635BC1B188155,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072293Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:02.082{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A8581DD534DD6464DE9B57DC2FD01550,SHA256=7B630ECC9C0861B9715E77B23A45F19BE5FF93654610F47CB624EAB711184754,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031929Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:03.419{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2CEC9E474B3DC5EEE9CC6F9409BA65EF,SHA256=6DFCD84496A2D640AC331B8DE10CB6C4D8DD634F8A13B40EB1B136485CF5A4CC,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000072295Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:01.366{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63285-false10.0.1.12-8000- 23542300x800000000000000072294Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:03.112{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3ACA17963DCFB22ABEC381BF2D2C1380,SHA256=20DAAF98BA566EA236D7B98FC16BB62E75E037C16215650127D0AEC6EA126389,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031928Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:03.044{50946567-0AF3-60EC-9E00-00000000DC01}3556NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=A52F6585761A8E82F695C029A0DE8E39,SHA256=23013549159043F148E7F54E2980270BD42A6AB4C4FA368424ACDA42C74194F9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031931Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:04.435{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1B7BD20C76DC08AD395ACB5D03AFA79A,SHA256=0412C14CA50FB2B89F90382C66DFB55065D8BD71C32F8E15F4FF9EB57119D29C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000031930Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:02.383{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51554-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000072296Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:04.133{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D430804DB945B4D434A620FC38F8F51E,SHA256=B7BA7E0E4E974EBE84558A8139280347BE3D62AA7F9EF2489C44641FFC055017,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031932Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:05.466{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=932DD821A673E6BAC7BDFD6351D09668,SHA256=B08AB4137F02496D156110C2CBBF93CD11F0BFE44C96C4ADE9540E98C49E9320,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072297Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:05.147{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F924A3C3AFC0F55B98BE7897D3ADC284,SHA256=52A31412057BCE8F55CB4C82BDE24CB7364EE536C1DDBBC03A792FB2D36C6E9F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072298Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:06.178{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=98A221E56ED71D15D64A6B1E2AD9F039,SHA256=CCC741B5537E8EF46F717EF5F5F5AF569620BC7A50F066B758F3474791F4B382,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031933Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:06.482{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F15A535708D6B68789425DDCB42FCAE0,SHA256=1BF967F0D697A9DF9E17F5E737CCD616F32D0AABD2163B577AA33CAE9B5C5FE5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000031935Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:04.524{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51555-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000031934Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:07.497{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B606C88E329C34CDF1BDC45C9C2C0169,SHA256=DBEF3B8CFCF19ADCB998E415A06762A3F077197F77972221E8BDD01306E0CC60,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072359Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.845{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072358Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.814{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072357Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.814{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072356Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.798{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072355Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.798{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072354Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.798{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072353Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.797{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072352Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.791{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072351Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.788{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072350Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.787{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072349Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.755{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2B8F-60EC-3C09-00000000DB01}5920C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+3b1a911|C:\Program Files\Mozilla Firefox\xul.dll+101a8a|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 23542300x800000000000000072348Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.659{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3F98CDD512204FA373146DA36365A96E,SHA256=511BFA06E505EAA9E1A660F68348CCAC72A088AB62AE0FA4D61F554D5AC49B85,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072347Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.624{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072346Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.604{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072345Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.598{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072344Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.594{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072343Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.594{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-22BA-60EC-9407-00000000DB01}3852C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072342Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.594{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6907-00000000DB01}8096C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072341Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.594{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072340Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.594{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21E0-60EC-7207-00000000DB01}6340C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072339Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.592{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-226C-60EC-8A07-00000000DB01}5640C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072338Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.576{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072337Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.567{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072336Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.564{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072335Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.557{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072334Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.554{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072333Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.551{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072332Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.550{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-22BA-60EC-9407-00000000DB01}3852C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+3b1a911|C:\Program Files\Mozilla Firefox\xul.dll+101a8a|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+3b1a911|C:\Program Files\Mozilla Firefox\xul.dll+101a8a|C:\Program Files\Mozilla Firefox\xul.dll+1b2763|UNKNOWN(00000059F97F1E84) 10341000x800000000000000072331Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.547{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072330Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.544{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072329Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.544{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072328Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.539{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072327Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.530{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072326Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.528{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072325Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.527{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072324Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.521{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6907-00000000DB01}8096C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+3b1a911|C:\Program Files\Mozilla Firefox\xul.dll+101a8a|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+3b1a911|C:\Program Files\Mozilla Firefox\xul.dll+101a8a|C:\Program Files\Mozilla Firefox\xul.dll+1b2763|UNKNOWN(00000059F97F1E84) 10341000x800000000000000072323Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.441{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072322Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.393{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072321Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.393{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072320Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.393{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072319Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.393{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072318Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.378{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072317Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.378{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072316Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.378{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072315Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.362{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072314Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.362{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072313Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.346{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072312Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.346{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072311Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.346{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072310Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.346{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072309Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.326{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21E0-60EC-7207-00000000DB01}6340C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+3b1a911|C:\Program Files\Mozilla Firefox\xul.dll+101a8a|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+3b1a911|C:\Program Files\Mozilla Firefox\xul.dll+101a8a|C:\Program Files\Mozilla Firefox\xul.dll+4fb7ea|C:\Program Files\Mozilla Firefox\xul.dll+23e75b6|C:\Program Files\Mozilla Firefox\xul.dll+23dfc59|C:\Program Files\Mozilla Firefox\xul.dll+244d41|C:\Program Files\Mozilla Firefox\xul.dll+23bb931 10341000x800000000000000072308Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.309{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072307Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.293{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072306Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.277{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072305Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.277{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072304Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.277{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072303Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.277{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072302Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.277{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072301Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.277{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072300Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.262{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-226C-60EC-8A07-00000000DB01}5640C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+3b1a911|C:\Program Files\Mozilla Firefox\xul.dll+101a8a|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+3b1a911|C:\Program Files\Mozilla Firefox\xul.dll+101a8a|C:\Program Files\Mozilla Firefox\xul.dll+4fb7ea|C:\Program Files\Mozilla Firefox\xul.dll+23e75b6|C:\Program Files\Mozilla Firefox\xul.dll+23e086a|C:\Program Files\Mozilla Firefox\xul.dll+244d41|C:\Program Files\Mozilla Firefox\xul.dll+23bb931 23542300x800000000000000072299Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.193{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AF32BACFA84DE54817FDCE2B07584C3D,SHA256=5A32ACF54FF78CFD0614FA8C9E0DD85FA9C4B847B327A048CE220068728224AC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031936Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:08.685{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=44B5986462CC584E49C8A29545A93AEA,SHA256=9A143DE78CA07A57B3228ECF033D9327670FEDE5967BBCC96A9A8C2D4EB5A3F5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072415Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.945{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072414Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.945{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072413Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.945{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072412Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.929{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072411Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.929{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072410Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.929{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072409Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.929{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072408Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.929{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072407Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.929{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072406Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.914{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6907-00000000DB01}8096C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+3b1a911|C:\Program Files\Mozilla Firefox\xul.dll+101a8a|C:\Program Files\Mozilla Firefox\xul.dll+1b2763|UNKNOWN(00000059F97F1E84) 354300x800000000000000072405Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:07.297{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63286-false10.0.1.12-8000- 10341000x800000000000000072404Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.829{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072403Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.798{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072402Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.796{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072401Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.776{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072400Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.776{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072399Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.776{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072398Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.776{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072397Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.776{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072396Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.776{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072395Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.776{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072394Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.761{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072393Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.761{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072392Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.761{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072391Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.761{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6907-00000000DB01}8096C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072390Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.761{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-22BA-60EC-9407-00000000DB01}3852C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072389Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.761{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2AAE-60EC-1109-00000000DB01}4020C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072388Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.761{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2B8F-60EC-3C09-00000000DB01}5920C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072387Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.761{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072386Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.761{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072385Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.761{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072384Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.761{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-226C-60EC-8A07-00000000DB01}5640C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+3b1a911|C:\Program Files\Mozilla Firefox\xul.dll+101a8a|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 10341000x800000000000000072383Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.761{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072382Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.761{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072381Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.761{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072380Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.745{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6907-00000000DB01}8096C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+3b1a911|C:\Program Files\Mozilla Firefox\xul.dll+101a8a|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 10341000x800000000000000072379Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.745{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072378Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.745{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072377Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.729{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072376Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.729{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072375Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.729{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072374Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.729{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072373Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.729{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072372Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.714{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072371Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.714{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072370Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.714{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-22BA-60EC-9407-00000000DB01}3852C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+3b1a911|C:\Program Files\Mozilla Firefox\xul.dll+101a8a|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 10341000x800000000000000072369Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.530{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000072368Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.214{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=33125367AA5592444136686390407086,SHA256=FBA6A6C15CD955323DD91AF522182AE89607EE691914C08E6CC0342024945E41,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072367Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.145{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072366Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.130{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072365Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.130{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072364Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.130{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072363Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.114{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072362Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.114{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072361Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.114{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072360Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:08.114{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2AAE-60EC-1109-00000000DB01}4020C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+3b1a911|C:\Program Files\Mozilla Firefox\xul.dll+101a8a|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 23542300x800000000000000031937Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:09.685{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D5E94AC6D72E377F902A5BF81DA35659,SHA256=3A0EB1DA5AEDA7C62A7AE0FE8C3E8D8E5DD7D25E122527395EC075C004320205,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072431Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:09.860{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6907-00000000DB01}8096C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072430Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:09.860{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-226C-60EC-8A07-00000000DB01}5640C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072429Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:09.576{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072428Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:09.561{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2BB4-60EC-4409-00000000DB01}7908C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000072427Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:09.413{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E84D024190AD37C2770339E064D22369,SHA256=A910066FA12F428522F9A3A164854A5EDFBC3A39539F331DFF3D34B83DE08653,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072426Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:09.413{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ADC6E2ABAA2F0A6B82F93CB4B66C287D,SHA256=C8260D26931B970093919985B06C9B8E0ABA66A5A4ACB763777CB572DC933D6D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072425Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:09.076{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072424Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:09.061{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072423Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:09.061{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072422Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:09.045{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072421Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:09.045{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072420Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:09.045{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072419Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:09.045{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072418Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:09.045{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072417Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:09.029{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072416Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:09.029{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-22BA-60EC-9407-00000000DB01}3852C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 23542300x800000000000000031938Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:10.778{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FFA039699CE77E6FB4475F5116F05E10,SHA256=16CD83F7FAAA9796F2E66B7F160FE73E1F28983AA54978EF200E04AEA1EDC9F7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072481Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.613{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=346F6C504490BC64DA6BD217AFD65563,SHA256=CEEB0ADBC568426CB4EC0829251D4E94D8E0EE6D75242836270713FA8EA087A6,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072480Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.613{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072479Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.597{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072478Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.575{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072477Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.575{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072476Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.575{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072475Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.575{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072474Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.544{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072473Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.544{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072472Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.528{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072471Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.513{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21E0-60EC-7207-00000000DB01}6340C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072470Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.513{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-226C-60EC-8A07-00000000DB01}5640C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072469Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.513{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6907-00000000DB01}8096C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072468Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.513{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072467Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.513{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072466Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.513{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072465Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.513{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072464Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.513{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072463Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.513{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072462Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.513{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072461Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.497{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072460Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.497{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072459Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.497{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072458Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.497{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072457Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.497{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072456Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.497{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D4-60EC-7007-00000000DB01}6928C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 10341000x800000000000000072455Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.497{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072454Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.497{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072453Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.497{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072452Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.495{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072451Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.492{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072450Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.492{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072449Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.492{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072448Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.475{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072447Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.475{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072446Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.475{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072445Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.475{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21E0-60EC-7207-00000000DB01}6340C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 10341000x800000000000000072444Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.475{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072443Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.475{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072442Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.475{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072441Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.460{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072440Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.460{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072439Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.460{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072438Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.460{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072437Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.460{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072436Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.460{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072435Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.460{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072434Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.444{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-226C-60EC-8A07-00000000DB01}5640C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 10341000x800000000000000072433Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.444{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6907-00000000DB01}8096C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 23542300x800000000000000072432Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:10.428{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3A2A5B17B610FC1246A15B21EFDD0629,SHA256=5230EFE43797283B8E131CB8CB07D085BC38FA6C4713617F1027442B7A1595CB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072489Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:11.444{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=12CA56DED6D5458B2E53529813267183,SHA256=267E3E44D1150D3A216CCCC32E8766EC2F9F62FD578C6EE81E73530E5C030B13,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072488Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:11.296{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072487Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:11.296{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072486Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:11.260{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072485Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:11.244{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072484Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:11.144{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000072483Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:11.144{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 10341000x800000000000000072482Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:11.113{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-22BA-60EC-9407-00000000DB01}3852C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000031940Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:10.524{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51556-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000031939Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:12.028{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A8E621AA873D46AD946C88655FA0BB51,SHA256=6DEC97D76CAA4A2F745728EE6C150492B4B43640368CF5CF7F3E18DB2CA34F2B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072526Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.859{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8F454683651F0921CFE03C818A7B13C1,SHA256=3163663E92565BF03DCCF1E57E1A3B5A370525F15929D059F77C21CD261D6283,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072525Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.460{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072524Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.460{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072523Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.460{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072522Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.445{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072521Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.445{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072520Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.445{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072519Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.429{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21E0-60EC-7207-00000000DB01}6340C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072518Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.429{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-226C-60EC-8A07-00000000DB01}5640C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072517Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.429{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6907-00000000DB01}8096C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072516Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.429{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D4-60EC-7007-00000000DB01}6928C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072515Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.429{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072514Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.429{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072513Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.429{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072512Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.414{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072511Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.414{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072510Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.414{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072509Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.397{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072508Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.397{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21E0-60EC-7207-00000000DB01}6340C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+46bca03|UNKNOWN(00000059F97F3242) 10341000x800000000000000072507Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.396{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072506Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.395{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072505Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.394{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072504Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.384{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072503Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.381{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072502Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.358{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072501Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.358{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072500Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.358{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-226C-60EC-8A07-00000000DB01}5640C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+46bca03|UNKNOWN(00000059F97F3242) 10341000x800000000000000072499Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.174{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072498Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.174{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072497Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.174{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072496Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.174{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072495Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.174{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072494Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.159{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072493Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.159{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072492Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.159{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072491Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.159{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072490Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.143{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6907-00000000DB01}8096C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+46bca03|UNKNOWN(00000059F97F3242) 10341000x800000000000000072631Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.866{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-226C-60EC-8A07-00000000DB01}5640C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000072630Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.776{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C53D397A3EB1E41B5619D226D35AC0AD,SHA256=83F49224AAA0FE0E28C6AB5F47B0700034F0FF4441AF346816D0D467E60D1411,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031941Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:13.075{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED3B39A154C644DD0500E31503F163B8,SHA256=F69F138AD5BD13AD26AFCE8468D51F7C76AD99CF9BEF6A4D48D56D6D1A38F5C9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072629Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.657{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072628Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.637{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072627Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.637{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072626Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.598{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072625Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.594{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072624Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.588{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072623Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.587{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072622Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.586{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d8d317|C:\Program Files\Mozilla Firefox\xul.dll+da05d3 10341000x800000000000000072621Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.586{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d 10341000x800000000000000072620Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.585{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072619Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.585{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072618Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.583{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072617Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.174{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072616Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.159{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072615Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.159{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072614Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.159{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072613Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.159{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072612Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.159{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000072611Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.159{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=259470FE449C5B83C7E81AEA110BCCA9,SHA256=4F4BC1F28C06FEC15355002C397D18D4D17B83B8BE50C1CAFC87B4A93A9FE3BD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072610Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.159{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072609Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.143{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072608Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.143{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072607Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.143{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072606Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.143{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072605Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.143{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6907-00000000DB01}8096C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+46bca03|UNKNOWN(00000059F97F3242) 10341000x800000000000000072604Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.127{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072603Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.127{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072602Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.127{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072601Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.127{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072600Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.112{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072599Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.112{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072598Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.112{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072597Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.112{8057F119-21D0-60EC-6307-00000000DB01}71727644C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072596Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.112{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-226C-60EC-8A07-00000000DB01}5640C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+46bca03|UNKNOWN(00000059F97F3242) 734700x800000000000000072595Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.096{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\lgpllibs.dll89.0.2-FirefoxMozilla Foundationlgpllibs.dllMD5=C26243875CD41F62FBB4CD7EAD35ADF8,SHA256=3608905BA86A24A4504C566A78F5EDB34AB82B4E7E122C94A0115A9778176262,IMPHASH=451AECEA9F58042E76D96A82BE2804FAtrueMozilla CorporationValid 734700x800000000000000072594Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.096{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000072593Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.096{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winmmbase.dll10.0.14393.0 (rs1_release.160715-1616)Base Multimedia Extension API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMMbase.DLLMD5=24C1E8F8C10471C5A6F0E8AF141211EB,SHA256=75ECAE23C920D81614BA5C0648377C2FC04C7379FD6A388C244A81F50AAB7B1C,IMPHASH=0B9A3C99AAFA99247F9E2BD866186AEAtrueMicrosoft WindowsValid 734700x800000000000000072592Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.096{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wsock32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Socket 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationwsock32.dllMD5=9471D5E2FEDF5552440BF935143DFAB0,SHA256=B489197F05EFFFB17F10FA9942DB88100C86BEB8291F9ACC8EB38BEF751BF90D,IMPHASH=6D33A1BDF842DEBFB889C44A830190E7trueMicrosoft WindowsValid 734700x800000000000000072591Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.096{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winmm.dll10.0.14393.0 (rs1_release.160715-1616)MCI API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMM.DLLMD5=F16410F5D557337B05CF4F93691EC106,SHA256=2B5BC3C0A6514356C6719298FC25D8D192A2C973EE3283EF48379D2745C9BD87,IMPHASH=9F0D37252D56D3F9E44E69CCC59B57AEtrueMicrosoft WindowsValid 734700x800000000000000072590Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.096{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000072589Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.096{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\nss3.dll89.0.2-FirefoxMozilla Foundationnss3.dllMD5=DAD0CC36A4013E1804F919826332FB52,SHA256=0111E8EAE224825AB76DB9C75A5C0F8285B5A7859F9463F35E80A4E1A9077166,IMPHASH=0DFC68B8DD02D4E1CB73F90762A0E3D7trueMozilla CorporationValid 23542300x800000000000000072588Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.093{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4ECB88780B5941D88551AAE3B2BAC976,SHA256=C125AA3701A2E3DE073793D7DD2DF15FB7D6313B5AEAC66E4F6B984A2ACA3494,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072587Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.059{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05 10341000x800000000000000072586Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.059{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d 10341000x800000000000000072585Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.059{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000072584Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.059{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 734700x800000000000000072583Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.043{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000072582Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.043{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000072581Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.043{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\vcruntime140_1.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140_1.dllMD5=4DC09CA657822C2E8160255F767597DF,SHA256=922124BA0821AA864A0261ED88BD25F8E40F94C24D00D389E23CD9AB2BFC6BA4,IMPHASH=AE0BDE6314FA2027B54CE04898F6AB69trueMicrosoft CorporationValid 734700x800000000000000072580Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.043{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000072579Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.043{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\version.dll10.0.14393.0 (rs1_release.160715-1616)Version Checking and File Installation LibrariesMicrosoft® Windows® Operating SystemMicrosoft CorporationVERSION.DLLMD5=CFDB018AC09F879CAAE7A66CA7880D57,SHA256=6AB95FD0D142CFFC3B9455AF51F003E1CD75B7F4323820390B975F9E1C8A47A5,IMPHASH=9A7C66851249D4CED6C2C9096DCA243BtrueMicrosoft WindowsValid 734700x800000000000000072578Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.043{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\vcruntime140.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140.dllMD5=ADE7AAC069131F54E4294F722C17A412,SHA256=92D50F7C4055718812CD3D823AA2821D6718EB55D2AB2BAC55C2E47260C25A76,IMPHASH=44C3854843F7A3FCCDF8DDBBEA66F302trueMicrosoft CorporationValid 734700x800000000000000072577Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.043{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcp140.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationmsvcp140.dllMD5=4B6BA0947F115AE9FD3016D26D57ABB8,SHA256=254DF96324D019A7C4213ABD4178944B8BF2873D0C3EDC1835D4C668F83D7C37,IMPHASH=4F1912F58F8D1AE7998EF5303198D62DtrueMicrosoft CorporationValid 734700x800000000000000072576Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.043{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wintrust.dll10.0.14393.4350 (rs1_release.210407-2154)Microsoft Trust Verification APIsMicrosoft® Windows® Operating SystemMicrosoft CorporationWINTRUST.DLLMD5=D8CD8451D1E194230F18866AD6EFE5E7,SHA256=9977AA1287962035C24DF806DDA67F09FFE9BDF696DBA507D749C624AE1C178D,IMPHASH=EC9695F0DF1F52E9D439A942DBDAA111trueMicrosoft WindowsValid 734700x800000000000000072575Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.043{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msasn1.dll10.0.14393.0 (rs1_release.160715-1616)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=299464D218A27B56684B715365D149FE,SHA256=2BFE4014E06552A9D4201EF9D1C605694AAF2B7B811265EFD91FC6D1C2D48242,IMPHASH=B6562243FBF394F03046E917C719260FtrueMicrosoft WindowsValid 734700x800000000000000072574Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.043{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\crypt32.dll10.0.14393.4350 (rs1_release.210407-2154)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=95BA70CFA8087A209500D7D350BF3A59,SHA256=4265157E8DC2A0E32A6328D54181CC31FD24E3017E60B270623C2CDBE5FAB4FA,IMPHASH=5BAA515B293A764CA06512D078C4E624trueMicrosoft WindowsValid 734700x800000000000000072573Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.043{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\mozglue.dll89.0.2-FirefoxMozilla Foundationmozglue.dllMD5=643C9F1023F93F67AB5428DD5B2FF202,SHA256=CBABCF2276C08C73B51E49D2A2E4B79AD00642489EEA06660478EAAF25D49222,IMPHASH=64E64553E32D273745DEE4A979FDA47BtrueMozilla CorporationValid 734700x800000000000000072572Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000072571Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000072570Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000072569Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000072568Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 17141700x800000000000000072567Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-CreatePipe2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.7172.82.137641830C:\Program Files\Mozilla Firefox\firefox.exe 17141700x800000000000000072566Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-CreatePipe2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.7172.81.39885239C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000072565Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+3e82ac|C:\Program Files\Mozilla Firefox\xul.dll+3e81fc|C:\Program Files\Mozilla Firefox\xul.dll+12b23b8|C:\Program Files\Mozilla Firefox\xul.dll+1307c21|C:\Program Files\Mozilla Firefox\xul.dll+1866ca1|C:\Program Files\Mozilla Firefox\xul.dll+29d482c|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 17141700x800000000000000072564Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-CreatePipe2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.7172.80.113791594C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000072563Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+3e82ac|C:\Program Files\Mozilla Firefox\xul.dll+3e81fc|C:\Program Files\Mozilla Firefox\xul.dll+12b23b8|C:\Program Files\Mozilla Firefox\xul.dll+1307b21|C:\Program Files\Mozilla Firefox\xul.dll+1866abe|C:\Program Files\Mozilla Firefox\xul.dll+29d482c|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 17141700x800000000000000072562Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-CreatePipe2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.7172.79.187167963C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000072561Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+3e82ac|C:\Program Files\Mozilla Firefox\xul.dll+3e81fc|C:\Program Files\Mozilla Firefox\xul.dll+12b23b8|C:\Program Files\Mozilla Firefox\xul.dll+1307a21|C:\Program Files\Mozilla Firefox\xul.dll+1866904|C:\Program Files\Mozilla Firefox\xul.dll+29d482c|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 17141700x800000000000000072560Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-CreatePipe2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.7172.78.161306473C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000072559Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+3e82ac|C:\Program Files\Mozilla Firefox\xul.dll+3e81fc|C:\Program Files\Mozilla Firefox\xul.dll+12b23b8|C:\Program Files\Mozilla Firefox\xul.dll+1307921|C:\Program Files\Mozilla Firefox\xul.dll+1866745|C:\Program Files\Mozilla Firefox\xul.dll+29d482c|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 17141700x800000000000000072558Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-CreatePipe2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.7172.77.154572592C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000072557Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29f47e9|C:\Program Files\Mozilla Firefox\xul.dll+29d4700|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000072556Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 10341000x800000000000000072555Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+e14869|C:\Program Files\Mozilla Firefox\xul.dll+29d4402|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 10341000x800000000000000072554Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+e14869|C:\Program Files\Mozilla Firefox\xul.dll+29d4402|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 10341000x800000000000000072553Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+e14869|C:\Program Files\Mozilla Firefox\xul.dll+29d4402|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 10341000x800000000000000072552Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+e14869|C:\Program Files\Mozilla Firefox\xul.dll+29d4402|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 10341000x800000000000000072551Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+e14869|C:\Program Files\Mozilla Firefox\xul.dll+29d4402|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 10341000x800000000000000072550Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+e14869|C:\Program Files\Mozilla Firefox\xul.dll+29d4402|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 10341000x800000000000000072549Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+e14869|C:\Program Files\Mozilla Firefox\xul.dll+29d4402|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 10341000x800000000000000072548Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+e14869|C:\Program Files\Mozilla Firefox\xul.dll+29d4402|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 10341000x800000000000000072547Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+e14869|C:\Program Files\Mozilla Firefox\xul.dll+29d4402|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 10341000x800000000000000072546Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+e14869|C:\Program Files\Mozilla Firefox\xul.dll+29d4402|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 734700x800000000000000072545Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 10341000x800000000000000072544Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+e14869|C:\Program Files\Mozilla Firefox\xul.dll+29d4402|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 10341000x800000000000000072543Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+e14869|C:\Program Files\Mozilla Firefox\xul.dll+29d4402|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 10341000x800000000000000072542Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+e14869|C:\Program Files\Mozilla Firefox\xul.dll+29d4402|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594 10341000x800000000000000072541Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12b5348|C:\Program Files\Mozilla Firefox\xul.dll+29f8902|C:\Program Files\Mozilla Firefox\xul.dll+29d439e|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000072540Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+29d4315|C:\Program Files\Mozilla Firefox\xul.dll+29f0a0c|C:\Program Files\Mozilla Firefox\xul.dll+29f083e|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+41333|C:\Program Files\Mozilla Firefox\xul.dll+122af80|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072539Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-21D0-60EC-6307-00000000DB01}71727612C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x101451C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+122110f|C:\Program Files\Mozilla Firefox\xul.dll+cfd024|C:\Program Files\Mozilla Firefox\xul.dll+1fe73|C:\Program Files\Mozilla Firefox\xul.dll+11fc728|C:\Program Files\Mozilla Firefox\xul.dll+1f215|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+1e76f|C:\Program Files\Mozilla Firefox\xul.dll+11fd4a1|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000072538Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000072537Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.027{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\firefox.exe89.0.2FirefoxFirefoxMozilla Corporationfirefox.exeMD5=EB061721B388D0AB67504EA4E0B9CB90,SHA256=F01545312FED4B611BC377F700B6B3AD16C5792D1D6AA5F695D61D8A7B0F23E3,IMPHASH=C483AB042998E5D3F9AC1D5A7C7ABDB2trueMozilla CorporationValid 10341000x800000000000000072536Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.012{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072535Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.012{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072534Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.012{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072533Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.012{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072532Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.012{8057F119-21B7-60EC-3B07-00000000DB01}55123720C:\Windows\system32\csrss.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000072531Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.012{8057F119-21D0-60EC-6307-00000000DB01}71727884C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\ADVAPI32.dll+188af|C:\Program Files\Mozilla Firefox\firefox.exe+4330b|C:\Program Files\Mozilla Firefox\firefox.exe+24848|C:\Program Files\Mozilla Firefox\xul.dll+cfe4da|C:\Program Files\Mozilla Firefox\xul.dll+1217834|C:\Program Files\Mozilla Firefox\xul.dll+1215b02|C:\Program Files\Mozilla Firefox\xul.dll+122249e|C:\Program Files\Mozilla Firefox\xul.dll+da6214|C:\Program Files\Mozilla Firefox\xul.dll+40976|C:\Program Files\Mozilla Firefox\xul.dll+3f85a|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+dabd27|C:\Program Files\Mozilla Firefox\nss3.dll+fac5a|C:\Program Files\Mozilla Firefox\nss3.dll+ee441|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000072530Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.015{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe89.0.2FirefoxFirefoxMozilla Corporationfirefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7172.76.1684477410\1647128621" -childID 11 -isForBrowser -prefsHandle 8332 -prefMapHandle 3816 -prefsLen 16223 -prefMapSize 232815 -parentBuildID 20210622155641 -appdir "C:\Program Files\Mozilla Firefox\browser" - 7172 "\\.\pipe\gecko-crash-server-pipe.7172" 7668 tabC:\Program Files\Mozilla Firefox\ATTACKRANGE\bob{8057F119-21B7-60EC-6B46-520000000000}0x52466b3LowMD5=EB061721B388D0AB67504EA4E0B9CB90,SHA256=F01545312FED4B611BC377F700B6B3AD16C5792D1D6AA5F695D61D8A7B0F23E3,IMPHASH=C483AB042998E5D3F9AC1D5A7C7ABDB2{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" 10341000x800000000000000072529Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.012{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05 10341000x800000000000000072528Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.012{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d 17141700x800000000000000072527Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-CreatePipe2021-07-12 12:02:12.996{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.7172.76.168447741C:\Program Files\Mozilla Firefox\firefox.exe 23542300x800000000000000072728Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.806{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7CAE5311021CD58B8C2315486743D9CD,SHA256=8EB7E555493F7D4500825EE3DAE356348B404C395811F335833787E18B881D3A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031942Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:14.200{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A755083E3E233A20F6A1439A11CDE297,SHA256=652ECFDA54B7086F918BBAC34640209C02EBCA3D19F06BE234AF142FC6DD4287,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072727Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.779{8057F119-08A1-60EC-1000-00000000DB01}1001724C:\Windows\system32\svchost.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000072726Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.695{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6F778BDBE2C434FDC5504D8449AD133B,SHA256=BCCD42554826A9696E661ABA986DB6B9BCE23A195D13AE107F2812BD13C5BA53,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000072725Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.623{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\freebl3.dll89.0.2-FirefoxMozilla Foundationfreebl3.dllMD5=D7E96576A0BD635C026D5F665765E570,SHA256=9DECCB1E81E68D430A0EEA23B6FE91283CAF5C7672912C9567074291D2BB9A8F,IMPHASH=53652A7DC9DFE48EFEF7CDBD318659AFtrueMozilla CorporationValid 734700x800000000000000072724Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.623{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\softokn3.dll89.0.2-FirefoxMozilla Foundationsoftokn3.dllMD5=16E00F7D53C4B0A7F6E7E6F3D2489C4B,SHA256=49B335D71C79E0049C97CC42F1CDE4483738D86429ED3E0EFD581AEBF3A33778,IMPHASH=8217C8B17239D6236F43DE3AC007B8A6trueMozilla CorporationValid 18141800x800000000000000072723Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-ConnectPipe2021-07-12 12:02:14.592{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.10088.4.171044199C:\Program Files\Mozilla Firefox\firefox.exe 17141700x800000000000000072722Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-CreatePipe2021-07-12 12:02:14.592{8057F119-2F45-60EC-EE09-00000000DB01}10088\chrome.10088.4.171044199C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000072721Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.560{8057F119-21D0-60EC-6307-00000000DB01}71727864C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+121a0bc|C:\Program Files\Mozilla Firefox\xul.dll+13233a1|C:\Program Files\Mozilla Firefox\xul.dll+1f4e71|C:\Program Files\Mozilla Firefox\xul.dll+1227e54|C:\Program Files\Mozilla Firefox\xul.dll+4127f|C:\Program Files\Mozilla Firefox\xul.dll+3f78f|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+dabd27|C:\Program Files\Mozilla Firefox\nss3.dll+fac5a|C:\Program Files\Mozilla Firefox\nss3.dll+ee441|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000072720Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-ConnectPipe2021-07-12 12:02:14.545{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.7172.82.137641830C:\Program Files\Mozilla Firefox\firefox.exe 18141800x800000000000000072719Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-ConnectPipe2021-07-12 12:02:14.545{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.7172.81.39885239C:\Program Files\Mozilla Firefox\firefox.exe 18141800x800000000000000072718Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-ConnectPipe2021-07-12 12:02:14.545{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.7172.80.113791594C:\Program Files\Mozilla Firefox\firefox.exe 18141800x800000000000000072717Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-ConnectPipe2021-07-12 12:02:14.545{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.7172.78.161306473C:\Program Files\Mozilla Firefox\firefox.exe 18141800x800000000000000072716Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-ConnectPipe2021-07-12 12:02:14.545{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.7172.79.187167963C:\Program Files\Mozilla Firefox\firefox.exe 18141800x800000000000000072715Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-ConnectPipe2021-07-12 12:02:14.545{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.7172.77.154572592C:\Program Files\Mozilla Firefox\firefox.exe 18141800x800000000000000072714Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-ConnectPipe2021-07-12 12:02:14.541{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.10088.3.171054042C:\Program Files\Mozilla Firefox\firefox.exe 17141700x800000000000000072713Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-CreatePipe2021-07-12 12:02:14.541{8057F119-2F45-60EC-EE09-00000000DB01}10088\chrome.10088.3.171054042C:\Program Files\Mozilla Firefox\firefox.exe 734700x800000000000000072712Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.533{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\xmllite.dll10.0.14393.3143 (rs1_release.190725-1725)Microsoft XmlLite LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationXmlLite.dllMD5=64E301CCFADF34810ADA8DE9DBC7720F,SHA256=6EAE1E0E610793C7DF2B27795553F377D2C4126CF74D8EE4A84DE3C3150871F8,IMPHASH=B53F82B33CA6ABD6251152A46E5FF78CtrueMicrosoft WindowsValid 10341000x800000000000000072711Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.537{8057F119-08A1-60EC-1000-00000000DB01}1001724C:\Windows\system32\svchost.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072710Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.536{8057F119-08A1-60EC-1000-00000000DB01}1001724C:\Windows\system32\svchost.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000072709Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.531{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\d2d1.dll10.0.14393.2969 (rs1_release.190503-1820)Microsoft D2D LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationd2d1MD5=E15A420D82314AF63973D7D0AB3BA2DD,SHA256=C264B2FA1F3E67E558E2671807C06270926EF456F4FF83F1F9859B18184F187E,IMPHASH=5F8C6AF7D0781F35A516AEB072DAD045trueMicrosoft WindowsValid 734700x800000000000000072708Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.351{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntmarta.dll10.0.14393.0 (rs1_release.160715-1616)Windows NT MARTA providerMicrosoft® Windows® Operating SystemMicrosoft Corporationntmarta.dllMD5=854A3CAE7C97B630158C9F7EE8555970,SHA256=20F0A4D99C5095A0CAC39B816BFC987F64CD051843C79E027714666375986176,IMPHASH=98050D95AE15C8382F287539F2BF65FAtrueMicrosoft WindowsValid 734700x800000000000000072707Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.328{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\windows.storage.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=741A68372CABC432883994C6EC1BCD94,SHA256=7ECE6E6CBA15A2A61787E7ED94ECF3533CC7F9FE6842ADA1A77D96656EA0128A,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000072706Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.478{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\d3d10warp.dll10.0.14393.2608 (rs1_release.181024-1742)Direct3D 10 RasterizerMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D10Warp.dllMD5=B69F0419A16A616FE2D779EC98CD7FB9,SHA256=2D10B43F2137433E48A009227487C691E312D186691485D33B4FDF90D8423C9D,IMPHASH=E32C7474360C94A9FE5E17141A4AB35FtrueMicrosoft WindowsValid 734700x800000000000000072705Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.328{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\shell32.dll10.0.14393.4467 (rs1_release.210604-1844)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=8FCB0790BEFBC63A59A61DC3EBE46827,SHA256=68705799702251D6DCCAA59A3EA90A8C28BC57FFC3E17F36300CDAA06355491D,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 734700x800000000000000072704Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.452{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ResourcePolicyClient.dll10.0.14393.3808 (rs1_release.200707-2105)Resource Policy ClientMicrosoft® Windows® Operating SystemMicrosoft CorporationResourcePolicyClient.dllMD5=8FD5FEFE4E020BBC2D95F07BCDC84F71,SHA256=E5E351822CCDEBF81C47C4CA1D5C158E2880C1BD29CA024D163FD9316F3046AE,IMPHASH=E494F732179E765F2CE18BC21CDB1948trueMicrosoft WindowsValid 734700x800000000000000072703Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.449{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dxgi.dll10.0.14393.2457 (rs1_release_inmarket.180822-1743)DirectX Graphics InfrastructureMicrosoft® Windows® Operating SystemMicrosoft Corporationdxgi.dllMD5=3C32D763740C83DB2C44DEA4B6F18C54,SHA256=ED26DBB9C3656767CA25887CDC3B45CF978AFC75E064FF5457A36C7A69E55223,IMPHASH=83736A76214A92F5C1B53248D0C22863trueMicrosoft WindowsValid 734700x800000000000000072702Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.443{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\d3d11.dll10.0.14393.4467 (rs1_release.210604-1844)Direct3D 11 RuntimeMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D11.dllMD5=F940A91B13592184F228ECC14D8D9358,SHA256=2BC05A4D09CDBAB8DB5F767DC95F31B2CA324928A94F004C7C2968E3E9E635E2,IMPHASH=460DAE5CA92CB705C37D78BE630D6120trueMicrosoft WindowsValid 734700x800000000000000072701Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.417{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\DWrite.dll10.0.14393.4225 (rs1_release.210127-1811)Microsoft DirectX Typography ServicesMicrosoft® Windows® Operating SystemMicrosoft CorporationDWriteMD5=BB0ECCB8A72B5926A58433666145D459,SHA256=9C082B0EF00A6E174062634F0421B1179D27BC9077A5C0B1FEB2AA74DBAC2E68,IMPHASH=4DF173E853B52F621D05CC337B9F72CEtrueMicrosoft WindowsValid 734700x800000000000000072700Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.414{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\devobj.dll10.0.14393.0 (rs1_release.160715-1616)Device Information Set DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationdevinfoset.DLLMD5=72AD993A6E896EB50058A73D045F3284,SHA256=CFF524F52D5F91788F34A47076E0CA36132890981079B27F559279B3F6FC3B11,IMPHASH=DFDCA72C641F8587ADF49CA0ED1D5817trueMicrosoft WindowsValid 18141800x800000000000000072699Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-ConnectPipe2021-07-12 12:02:14.412{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.10088.2.99008064C:\Program Files\Mozilla Firefox\firefox.exe 18141800x800000000000000072698Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-ConnectPipe2021-07-12 12:02:14.412{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.10088.1.112519335C:\Program Files\Mozilla Firefox\firefox.exe 17141700x800000000000000072697Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-CreatePipe2021-07-12 12:02:14.412{8057F119-2F45-60EC-EE09-00000000DB01}10088\chrome.10088.2.99008064C:\Program Files\Mozilla Firefox\firefox.exe 17141700x800000000000000072696Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-CreatePipe2021-07-12 12:02:14.411{8057F119-2F45-60EC-EE09-00000000DB01}10088\chrome.10088.1.112519335C:\Program Files\Mozilla Firefox\firefox.exe 18141800x800000000000000072695Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-ConnectPipe2021-07-12 12:02:14.411{8057F119-2F45-60EC-EE09-00000000DB01}10088\chrome.10088.0.176808620C:\Program Files\Mozilla Firefox\firefox.exe 17141700x800000000000000072694Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-CreatePipe2021-07-12 12:02:14.410{8057F119-2F45-60EC-EE09-00000000DB01}10088\chrome.10088.0.176808620C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000072693Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.409{8057F119-089F-60EC-0B00-00000000DB01}6323996C:\Windows\system32\lsass.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24c07|C:\Windows\system32\lsasrv.dll+25d4d|C:\Windows\system32\lsasrv.dll+24a85|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072692Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.409{8057F119-089F-60EC-0B00-00000000DB01}6323996C:\Windows\system32\lsass.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249cd|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000072691Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.408{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000072690Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.371{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\nlaapi.dll10.0.14393.3808 (rs1_release.200707-2105)Network Location Awareness 2Microsoft® Windows® Operating SystemMicrosoft Corporationnlaapi.dllMD5=63EB5F68082B8C8C392E5DAC1D4EC678,SHA256=58EC364601FA6FE26525D8ADB44B7EDEFCFB73E72897C77B6E37F73E1C7BF871,IMPHASH=0B7F4620EB804B43452C1AFA5341A2C2trueMicrosoft WindowsValid 734700x800000000000000072689Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.369{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winrnr.dll10.0.14393.0 (rs1_release.160715-1616)LDAP RnR Provider DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationwinrnrMD5=B0DE13ABF238AB28E963629B977A012F,SHA256=43288C8A658C2F0CB0CB1C9D874506D6CEEF455AAB68CE2EF0D685DE8E3BA0C3,IMPHASH=77C2BDF68EAD031D294626FB2F3033A1trueMicrosoft WindowsValid 734700x800000000000000072688Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.367{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\mswsock.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft Windows Sockets 2.0 Service ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationmswsock.dllMD5=B52ACA309FD6F72105951FFBA022327B,SHA256=02AB6CCE4BF0D3F075D5E982F5A4CBDB514CE7C245EA474D7846A86CD3F13202,IMPHASH=0E9C1FA273A5EFD763FAC8E145B20C80trueMicrosoft WindowsValid 734700x800000000000000072687Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.366{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\NapiNSP.dll10.0.14393.0 (rs1_release.160715-1616)E-mail Naming Shim ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationnapinsp.dllMD5=71514D9A6350A37B4F0BAA6ACB751771,SHA256=5DB99D6784900D85BB4A62E9F40B4EC628054D41B38A5E93F80C7A8BB066EBBB,IMPHASH=8D3297F500E5144336C044019A1ACFD4trueMicrosoft WindowsValid 10341000x800000000000000072686Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.366{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12b3568|C:\Program Files\Mozilla Firefox\xul.dll+122d767|C:\Program Files\Mozilla Firefox\xul.dll+12e44e9|C:\Program Files\Mozilla Firefox\xul.dll+29dfd24|C:\Program Files\Mozilla Firefox\xul.dll+12bfb3c|C:\Program Files\Mozilla Firefox\xul.dll+1227e54|C:\Program Files\Mozilla Firefox\xul.dll+da0207|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4 18141800x800000000000000072685Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-ConnectPipe2021-07-12 12:02:14.366{8057F119-21D0-60EC-6307-00000000DB01}7172\cubeb-pipe-7172-10C:\Program Files\Mozilla Firefox\firefox.exe 17141700x800000000000000072684Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-CreatePipe2021-07-12 12:02:14.366{8057F119-21D0-60EC-6307-00000000DB01}7172\cubeb-pipe-7172-10C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000072683Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.352{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072682Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.350{8057F119-08A1-60EC-1600-00000000DB01}12361316C:\Windows\system32\svchost.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000072681Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-ConnectPipe2021-07-12 12:02:14.349{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.7172.76.168447741C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000072680Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.347{8057F119-21D0-60EC-6307-00000000DB01}71727844C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+29ffab|C:\Program Files\Mozilla Firefox\xul.dll+3a5b85b|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000072679Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-ConnectPipe2021-07-12 12:02:14.347{8057F119-21D0-60EC-6307-00000000DB01}7172\gecko-crash-server-pipe.7172C:\Program Files\Mozilla Firefox\firefox.exe 734700x800000000000000072678Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.339{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\userenv.dll10.0.14393.3986 (rs1_release.201002-1707)UserenvMicrosoft® Windows® Operating SystemMicrosoft Corporationuserenv.dllMD5=047D26DCED07A10913C3E7C3A7502BED,SHA256=143C661F79AC6BB271452A10C2A19F6B1AAAAE43B4062B6CFF173F7D8ABC40FE,IMPHASH=C84FC60AE2A79A06E8C46A6929CDECB4trueMicrosoft WindowsValid 734700x800000000000000072677Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.338{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dhcpcsvc.dll10.0.14393.3930 (rs1_release.200901-1914)DHCP Client ServiceMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc.dllMD5=CD3B9633BBEF2102C4665A2C39EC0B1A,SHA256=341EFB4806BE39E09AA90CA3B069C39F2A9D61FA9B512350B2721D41875AFCAE,IMPHASH=9A2F821D250C4CEBC0627590331B869DtrueMicrosoft WindowsValid 734700x800000000000000072676Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.337{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wtsapi32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Remote Desktop Session Host Server SDK APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationwtsapi32.dllMD5=D0DB3DD09FB2B4ADABF4E719FAFC4EB9,SHA256=8B7C056B5F4AB604ED5077A39C63CE1B5A34929DE76DA4A3C54D6E648D123BAB,IMPHASH=AD7CEB919D43FA2BD394EC803EB6BCDAtrueMicrosoft WindowsValid 734700x800000000000000072675Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.336{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x800000000000000072674Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.336{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 734700x800000000000000072673Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.336{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000072672Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.335{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000072671Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.335{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000072670Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.335{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 734700x800000000000000072669Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.334{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\usp10.dll10.0.14393.3321 (rs1_release.191016-1811)Uniscribe Unicode script processorMicrosoft® Windows® Operating SystemMicrosoft CorporationUSP10.DLLMD5=ACF31D492FD578C0374EB20CC393BE98,SHA256=D49ECA60A94B30DB87CDCEB36F284D273E080E8689E4B0F99D5BD44FFD117A92,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000072668Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.333{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\avrt.dll10.0.14393.2969 (rs1_release.190503-1820)Multimedia Realtime RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationavrt.dllMD5=8EC9E2490A9FFA637115F758B22FFF78,SHA256=1A3295CBF09E9367CCE68505D949D724FB9B66B4516770B7D594273C3BCFC5B8,IMPHASH=F266C00A61E480BB0A81B1A89DB30014trueMicrosoft WindowsValid 734700x800000000000000072667Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.331{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000072666Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.331{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000072665Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.331{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\setupapi.dll10.0.14393.2608 (rs1_release.181024-1742)Windows Setup APIMicrosoft® Windows® Operating SystemMicrosoft CorporationSETUPAPI.DLLMD5=8EEA3E9E124AC395915517588723F12E,SHA256=ED63B8F0079069271F46EECCB4B0CF384D02BD1E18FE3BA635A0C0B1284B2CBE,IMPHASH=5910ADAAC44A92AFA6ED871531949CEEtrueMicrosoft WindowsValid 734700x800000000000000072664Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.330{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000072663Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.330{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000072662Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.330{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000072661Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.329{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000072660Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.329{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000072659Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.329{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000072658Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.328{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000072657Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.328{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000072656Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.327{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000072655Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.327{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000072654Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.327{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000072653Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.326{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000072652Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.326{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dll89.0.2-FirefoxMozilla Foundationxul.dllMD5=0B035EFE8C60D8587C4C4D0C5E219A0B,SHA256=4C39F07DAF9D94C93D6B986FBFC9E49D83C8D92634A604EF74B6C5A644AF971F,IMPHASH=15743E14CFF7B4E979D67C207A4DED47trueMozilla CorporationValid 354300x800000000000000072651Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.193{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local56381- 354300x800000000000000072650Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.193{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64166- 354300x800000000000000072649Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.193{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63432- 354300x800000000000000072648Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.191{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local57451- 354300x800000000000000072647Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.189{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local54619- 354300x800000000000000072646Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.189{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local56850- 354300x800000000000000072645Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.189{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local54617- 354300x800000000000000072644Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.188{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local62962- 354300x800000000000000072643Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.188{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local56858- 354300x800000000000000072642Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.187{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63182- 354300x800000000000000072641Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.187{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local54706- 22542200x800000000000000072640Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.063{8057F119-21D0-60EC-6307-00000000DB01}7172reddit.map.fastly.net0151.101.13.140;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000072639Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.063{8057F119-21D0-60EC-6307-00000000DB01}7172www.reddit.com0type: 5 reddit.map.fastly.net;::ffff:151.101.13.140;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000072638Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.060{8057F119-21D0-60EC-6307-00000000DB01}7172youtube-ui.l.google.com02a00:1450:4001:80e::200e;2a00:1450:4001:808::200e;2a00:1450:4001:80f::200e;2a00:1450:4001:810::200e;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000072637Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.058{8057F119-21D0-60EC-6307-00000000DB01}7172youtube-ui.l.google.com0142.250.181.238;216.58.212.174;142.250.74.206;142.250.186.46;142.250.186.78;142.250.186.110;172.217.18.110;172.217.23.110;216.58.212.142;142.250.185.78;172.217.16.142;142.250.185.110;142.250.185.142;142.250.185.174;142.250.185.206;142.250.185.238;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000072636Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.057{8057F119-21D0-60EC-6307-00000000DB01}7172www.youtube.com0type: 5 youtube-ui.l.google.com;::ffff:142.250.185.238;::ffff:142.250.181.238;::ffff:216.58.212.174;::ffff:142.250.74.206;::ffff:142.250.186.46;::ffff:142.250.186.78;::ffff:142.250.186.110;::ffff:172.217.18.110;::ffff:172.217.23.110;::ffff:216.58.212.142;::ffff:142.250.185.78;::ffff:172.217.16.142;::ffff:142.250.185.110;::ffff:142.250.185.142;::ffff:142.250.185.174;::ffff:142.250.185.206;C:\Program Files\Mozilla Firefox\firefox.exe 354300x800000000000000072635Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.185{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local54734- 354300x800000000000000072634Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:12.326{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63287-false10.0.1.12-8000- 23542300x800000000000000072633Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.043{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=11C7F6CD2DEDE6B0E2E4B18C565E4DFF,SHA256=797A5807602DC14B97D024FC7355A85927833E656A3D90E31E4D4A5D26ED9BFB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072632Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.041{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A6696134F98842D1C6D710498F66B3C0,SHA256=97D2C1BB829A0BC81FBCCA4A1C93DCD6AA5CF05A8B61BCA686003CEAD2E08418,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000072750Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.810{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64528- 354300x800000000000000072749Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.809{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local65294- 354300x800000000000000072748Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.808{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local60737- 354300x800000000000000072747Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.807{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63291-false172.67.4.132-443https 354300x800000000000000072746Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.807{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64377- 23542300x800000000000000072745Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.824{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8411D16725D69FF2EEF5DBE1952182D7,SHA256=F6DDB3C97838477DC9230ED3A63BBB6AA5321AA4D4F7E4D8D3A2B2B81C14F58F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031943Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:15.434{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=092704C3DB393834CD37D0852A1FA402,SHA256=4A567585B0950202E25FEC0C74C8D792A56AAC5763860277E4AFBB0154206D2A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072744Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.399{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6907-00000000DB01}8096C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072743Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.150{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072742Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.100{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072741Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.094{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072740Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.084{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072739Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.081{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072738Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.081{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072737Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.078{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000072736Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.350{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63289-false35.167.137.152ec2-35-167-137-152.us-west-2.compute.amazonaws.com443https 354300x800000000000000072735Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.209{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local57251- 354300x800000000000000072734Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.206{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local62450- 10341000x800000000000000072733Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.075{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072732Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.072{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072731Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.071{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072730Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.070{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-226C-60EC-8A07-00000000DB01}5640C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+46bca03|UNKNOWN(00000059F97F3242) 22542200x800000000000000072729Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:13.079{8057F119-21D0-60EC-6307-00000000DB01}7172pipeline-incoming-prod-elb-149169523.us-west-2.elb.amazonaws.com052.42.129.205;44.235.28.153;34.216.131.110;52.27.200.224;44.226.235.191;44.239.250.14;44.239.125.99;35.167.137.152;C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000072784Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.908{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072783Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.908{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072782Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.889{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072781Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.889{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072780Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.880{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072779Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.864{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072778Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.861{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072777Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.861{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072776Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.854{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072775Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.853{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072774Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.849{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072773Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.849{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072772Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.847{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D4-60EC-7007-00000000DB01}6928C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+46bca03|UNKNOWN(00000059F97F3242) 23542300x800000000000000072771Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.839{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F5A3E7F8ADCD5DE2EFF52661FA11ADB2,SHA256=802DA209152F66108AD2E57BECA221E2E3BCFB548F26681653927DDB50B43197,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031944Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:16.669{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1C8C344080B95B0D2EE53A5F8038B250,SHA256=D2F72958964A3DD7C6A4595086FD1CB34C197B709D8674B908A28D465DE917CA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072770Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.496{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072769Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.490{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-226C-60EC-8A07-00000000DB01}5640C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072768Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.211{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072767Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.208{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072766Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.205{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072765Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.190{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072764Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.188{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072763Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.188{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072762Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.179{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072761Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.178{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072760Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.162{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072759Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.157{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072758Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.157{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072757Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:16.150{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21E0-60EC-7207-00000000DB01}6340C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+46bca03|UNKNOWN(00000059F97F3242) 354300x800000000000000072756Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.936{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63294-false104.22.15.187-443https 354300x800000000000000072755Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.816{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63292-false69.16.175.42hwcdn.net443https 354300x800000000000000072754Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.813{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobudptruefalse10.0.1.14win-dc-89.attackrange.local56145-false142.250.185.106fra16s49-in-f10.1e100.net443https 354300x800000000000000072753Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.810{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local56144- 22542200x800000000000000072752Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.680{8057F119-21D0-60EC-6307-00000000DB01}7172cds.s5x3j6q5.hwcdn.net069.16.175.10;69.16.175.42;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000072751Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.680{8057F119-21D0-60EC-6307-00000000DB01}7172code.jquery.com0type: 5 cds.s5x3j6q5.hwcdn.net;::ffff:69.16.175.42;::ffff:69.16.175.10;C:\Program Files\Mozilla Firefox\firefox.exe 23542300x800000000000000031945Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:17.700{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F8646D2D93B34D577245E76B3A55C364,SHA256=A054BB5018F83865348DF03573E8001D49901A8C102173D86684082E63CCE5AE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072791Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:17.852{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BB36D0DBC334107EAC8606C9D42D57BF,SHA256=F99C425D962FB60209F711863FECC22C807764A7DD46C40B0163F7A7AD940E80,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000072790Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.008{8057F119-08A1-60EC-1400-00000000DB01}1076C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudpfalsefalse127.0.0.1-58448-false127.0.0.1-53domain 354300x800000000000000072789Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.005{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1-53domainfalse127.0.0.1-58448- 354300x800000000000000072788Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.005{8057F119-08A1-60EC-1400-00000000DB01}1076C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudptruetrue7f00:1:2428:4c89:9870:4a9:a8:ffff-58448-true7f00:1:0:0:0:0:0:0-53domain 354300x800000000000000072787Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.985{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63296-false104.22.14.187-443https 354300x800000000000000072786Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.981{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local59322- 354300x800000000000000072785Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:14.980{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local58448- 23542300x800000000000000031946Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:18.934{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5B5FB7D867BC1B4C64B01CEFF7FD4D42,SHA256=BC6EA01B73B6224C8822AE94B28FE0DD2C1F3511E33A68CB29E63D2ACE66A1B9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000072857Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.864{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=03187EBB8D83EA6AEDE0FAE88E5A8C98,SHA256=01EEE3093827495722EE34B026509656C4B5966C7108613AEF0586F12444C3CE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072856Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.808{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072855Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.803{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21E0-60EC-7207-00000000DB01}6340C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072854Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.533{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072853Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.518{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072852Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.494{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072851Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.484{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072850Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.483{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072849Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.477{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072848Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.461{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072847Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.451{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072846Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.450{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072845Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.442{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072844Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.442{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072843Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.437{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072842Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.437{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2B8F-60EC-3C09-00000000DB01}5920C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+46bca03|UNKNOWN(00000059F97F3242) 23542300x800000000000000072841Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.423{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=155E0116D299B53C5113533C693AD4D5,SHA256=BF16FF8CF737B9D0BE7147A783BA7567C77AB5DA09F3481725ED3997A7E6B014,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072840Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.329{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072839Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.328{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072838Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.271{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072837Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.253{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072836Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.248{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072835Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.246{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072834Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.238{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072833Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.236{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072832Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.233{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072831Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.227{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072830Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.221{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072829Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.221{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2B8F-60EC-3C09-00000000DB01}5920C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072828Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.221{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6907-00000000DB01}8096C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072827Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.221{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072826Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.219{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-226C-60EC-8A07-00000000DB01}5640C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072825Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.219{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D4-60EC-7007-00000000DB01}6928C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072824Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.209{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072823Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.200{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072822Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.197{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072821Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.196{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072820Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.188{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072819Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.188{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072818Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.186{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000072817Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.184{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cabinet.dll5.00 (rs1_release.160715-1616)Microsoft® Cabinet File APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcabinet.dllMD5=08A4A2712DB2AE10E483FB74E46B0E73,SHA256=EEB32E3E4256CC9935227ACD5BA576B75F1F6FE3C818D2127513CB22F823FECB,IMPHASH=536E202FBC448C2C3B40D60D87620951trueMicrosoft WindowsValid 10341000x800000000000000072816Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.179{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2B8F-60EC-3C09-00000000DB01}5920C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 10341000x800000000000000072815Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.178{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072814Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.176{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072813Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.173{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072812Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.164{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072811Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.160{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072810Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.150{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072809Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.146{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072808Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.142{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072807Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.137{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072806Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.134{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 10341000x800000000000000072805Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.129{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072804Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.125{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072803Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.123{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072802Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.109{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6907-00000000DB01}8096C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 10341000x800000000000000072801Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.104{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072800Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.093{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000072799Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:15.979{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local55704- 10341000x800000000000000072798Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.087{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072797Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.086{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072796Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.081{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072795Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.076{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072794Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.065{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072793Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.065{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072792Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.063{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-226C-60EC-8A07-00000000DB01}5640C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 23542300x800000000000000031948Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:19.966{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2CE3DB18EEB2E03E763F1DBC0C4C845E,SHA256=D12BA0382693850482DD6547F148D5C1348876275019A952647C1C74A4250A67,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072868Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:19.934{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000072867Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:19.934{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 23542300x800000000000000072866Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:19.886{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E461199767E5BC9F4830CDDA5C3C06AC,SHA256=728283FA4D60D7B0BF7E30E7FE5D73608820B99D11CB5A4FF220D936816287A2,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000031947Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:16.554{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51557-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000072865Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:19.807{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a 10341000x800000000000000072864Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:19.807{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002 10341000x800000000000000072863Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:19.287{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072862Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:19.286{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000072861Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:19.251{8057F119-2B8F-60EC-3C09-00000000DB01}5920C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cabinet.dll5.00 (rs1_release.160715-1616)Microsoft® Cabinet File APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcabinet.dllMD5=08A4A2712DB2AE10E483FB74E46B0E73,SHA256=EEB32E3E4256CC9935227ACD5BA576B75F1F6FE3C818D2127513CB22F823FECB,IMPHASH=536E202FBC448C2C3B40D60D87620951trueMicrosoft WindowsValid 10341000x800000000000000072860Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:19.245{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072859Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:19.244{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072858Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:19.083{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000072890Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.902{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF737F67C336506B12E5D47D3406ED70,SHA256=FA9667F5642AFBFF4580950244E4085E4BE2EF828F53DC7B8EF1CF9DC541350E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072889Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.710{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072888Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.709{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072887Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.707{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072886Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.682{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072885Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.681{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072884Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.669{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a 10341000x800000000000000072883Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.669{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002 10341000x800000000000000072882Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.663{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072881Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.655{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072880Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.650{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072879Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.648{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072878Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.648{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072877Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.642{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072876Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.637{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072875Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.631{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072874Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.630{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072873Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.629{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072872Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.627{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2BB4-60EC-4409-00000000DB01}7908C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 10341000x800000000000000072871Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.382{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d8d317|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f 10341000x800000000000000072870Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:20.381{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 354300x800000000000000072869Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:18.283{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63297-false10.0.1.12-8000- 23542300x800000000000000072891Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:21.913{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=48CDD43943C598D1EA937172372359FE,SHA256=77405927E5DB677C24C1CD5B816E72368BBD34FF037FA96E6ACD1B6AB75293BD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031949Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:21.169{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=20E5D7EE9C09125418C9FC660EA74CFD,SHA256=62B908F24E646FA4247F351AAFA74D4FFDC814CBAE906C2C14FD14541681A01B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072908Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.994{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072907Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.993{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000072906Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.991{8057F119-08A1-60EC-1100-00000000DB01}108NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=9E7A4A7085BF3AD338767D1FCA2488EA,SHA256=19A50D9E01AA79BD195F3715076C4E7A6359B879A7190F6D50F1847588947622,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072905Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.968{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072904Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.956{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072903Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.953{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072902Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.951{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072901Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.951{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072900Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.945{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072899Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.944{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2B8F-60EC-3C09-00000000DB01}5920C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072898Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.939{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072897Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.935{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072896Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.928{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072895Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.928{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072894Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.925{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2BB4-60EC-4409-00000000DB01}7908C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 23542300x800000000000000072893Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.921{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=55948B969B0F3A44466C9C5074C18252,SHA256=52D189D6F02C60E9F64473852F41D2E5D181E61C3ADCF5CC6CDADC8BDB3A13D4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031950Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:22.403{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5FBE2A016344FF55682A94490BE50287,SHA256=FC263DFA34B27B3E1C9F15460C1F047B9A7B5ED8CF75F740E6D362C5AF338716,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072892Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:22.629{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2BB4-60EC-4409-00000000DB01}7908C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031966Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:23.747{50946567-2F4F-60EC-2105-00000000DC01}33642800C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031965Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:23.575{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F4F-60EC-2105-00000000DC01}3364C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031964Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:23.575{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031963Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:23.575{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031962Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:23.575{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031961Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:23.575{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031960Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:23.575{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031959Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:23.575{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031958Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:23.575{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031957Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:23.575{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031956Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:23.575{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031955Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:23.575{50946567-0A80-60EC-0500-00000000DC01}4161044C:\Windows\system32\csrss.exe{50946567-2F4F-60EC-2105-00000000DC01}3364C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000031954Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:23.575{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F4F-60EC-2105-00000000DC01}3364C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000031953Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:23.576{50946567-2F4F-60EC-2105-00000000DC01}3364C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000031952Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:23.419{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A3D6DBDF3A6BBD6C508955CAFB702761,SHA256=129CEAEAFF4BE74DFF874EDADC7EA43E87A425ECD5ABBEC986DF1B2C8A3B7A42,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072922Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:23.474{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072921Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:23.454{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072920Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:23.452{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072919Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:23.451{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072918Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:23.325{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072917Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:23.318{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072916Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:23.306{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072915Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:23.303{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072914Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:23.302{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072913Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:23.299{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072912Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:23.293{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072911Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:23.286{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072910Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:23.285{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072909Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:23.282{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2B8F-60EC-3C09-00000000DB01}5920C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+46bca03|UNKNOWN(00000059F97F3242) 23542300x800000000000000031951Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:23.372{50946567-0A81-60EC-1100-00000000DC01}972NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=BC0972424FEC259B6732C08CD9B7F28F,SHA256=7F9AC57F00D28B6C2B10D187A0B601ED700C5038A22F650EF77D7634803B01FC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000031996Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.919{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F50-60EC-2305-00000000DC01}3432C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031995Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.919{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031994Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.919{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031993Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.919{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031992Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.919{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031991Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.919{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031990Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.919{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031989Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.919{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031988Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.919{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031987Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.919{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031986Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.919{50946567-0A80-60EC-0500-00000000DC01}416532C:\Windows\system32\csrss.exe{50946567-2F50-60EC-2305-00000000DC01}3432C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000031985Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.919{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F50-60EC-2305-00000000DC01}3432C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000031984Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.919{50946567-2F50-60EC-2305-00000000DC01}3432C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000031983Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.731{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A8EE798E2A6092E2A18D9701BFB26ACE,SHA256=B76944037669FF7F05470AE45B0BAC813DDC64778E1DC06B5647AC3CE5418C21,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072935Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.990{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072934Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.990{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072933Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.981{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072932Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.977{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072931Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.976{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072930Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.865{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d8d317|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f 10341000x800000000000000072929Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.864{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 10341000x800000000000000072928Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.810{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072927Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.407{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000072926Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.406{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 10341000x800000000000000072925Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.374{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05 10341000x800000000000000072924Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.374{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d 23542300x800000000000000072923Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.054{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4BC5C0BF9FC14FD088DC18763EA588CC,SHA256=F2370EE99D4731A9DE0698F923835C1A88730AB055390BF27D69F96723493CB5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031982Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.637{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=24CAF5AF0DED0C9E96FAB0C61B101244,SHA256=CC4A6CA1CABC5845D47FF43CCFCF48C65797DC256578A51C665844712ECFF2BB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000031981Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.637{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=AC520E28D4D6729374F3926D8A775732,SHA256=A8135730A510D138E6F2C3351BD98D5FD7065A71D9CD086F6586C429F1DC9FE8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000031980Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.387{50946567-2F50-60EC-2205-00000000DC01}33563784C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031979Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.247{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F50-60EC-2205-00000000DC01}3356C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031978Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.247{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031977Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.247{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031976Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.247{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031975Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.247{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031974Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.247{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031973Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.247{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031972Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.247{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031971Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.247{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031970Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.247{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000031969Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.247{50946567-0A80-60EC-0500-00000000DC01}4161044C:\Windows\system32\csrss.exe{50946567-2F50-60EC-2205-00000000DC01}3356C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000031968Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.247{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F50-60EC-2205-00000000DC01}3356C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000031967Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:24.247{50946567-2F50-60EC-2205-00000000DC01}3356C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000032015Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.934{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=24CAF5AF0DED0C9E96FAB0C61B101244,SHA256=CC4A6CA1CABC5845D47FF43CCFCF48C65797DC256578A51C665844712ECFF2BB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032014Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.872{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4CE7D10ECA3688D9BD39FAC05258260E,SHA256=0E9451D00ED8CB9BDF2170C7648E8205E739C5C7DD40E74CB889F4FC3EA0EFA3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000032013Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.825{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A81-60EC-1300-00000000DC01}772C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032012Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.825{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A81-60EC-1300-00000000DC01}772C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032011Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.825{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A81-60EC-1300-00000000DC01}772C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000072952Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.523{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63941- 354300x800000000000000072951Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.522{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63299-false140.82.121.3lb-140-82-121-3-fra.github.com443https 354300x800000000000000072950Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.520{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local65239- 354300x800000000000000072949Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.519{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local56170- 354300x800000000000000072948Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.519{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local62701- 22542200x800000000000000072947Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.391{8057F119-21D0-60EC-6307-00000000DB01}7172github.githubassets.com0::ffff:185.199.108.154;::ffff:185.199.109.154;::ffff:185.199.110.154;::ffff:185.199.111.154;C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000072946Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:25.300{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2B8F-60EC-3C09-00000000DB01}5920C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072945Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:25.139{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072944Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:25.113{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000072943Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:23.328{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63298-false10.0.1.12-8000- 10341000x800000000000000072942Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:25.078{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072941Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:25.077{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072940Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:25.075{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000072939Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:25.071{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=361CBAE1026D64AECEF627F6D34207B8,SHA256=429C512970AE2886751C48582C391BD0BAEB515EE8CE425988B68538920EC25C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072938Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:25.070{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072937Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:25.068{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032010Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.591{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F51-60EC-2405-00000000DC01}3912C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032009Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.591{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032008Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.591{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032007Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.591{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032006Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.591{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032005Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.591{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032004Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.591{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032003Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.591{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032002Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.591{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032001Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.591{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032000Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.591{50946567-0A80-60EC-0500-00000000DC01}416432C:\Windows\system32\csrss.exe{50946567-2F51-60EC-2405-00000000DC01}3912C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000031999Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.591{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F51-60EC-2405-00000000DC01}3912C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000031998Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:25.591{50946567-2F51-60EC-2405-00000000DC01}3912C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000031997Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:22.382{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51558-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000072936Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:25.006{8057F119-08AE-60EC-2D00-00000000DB01}3004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=A52F6585761A8E82F695C029A0DE8E39,SHA256=23013549159043F148E7F54E2980270BD42A6AB4C4FA368424ACDA42C74194F9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072977Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:26.989{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072976Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:26.989{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072975Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:26.968{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072974Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:26.958{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a 10341000x800000000000000072973Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:26.958{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002 23542300x800000000000000072972Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:26.937{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\permissions.sqlite-journalMD5=9E2411441700A3E2F03C202539041C6B,SHA256=2332C45ECA09A81312708201A4D4E67C7B11C6AFAFDD9EE9D91BF9622322D899,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072971Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:26.923{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000072970Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:26.922{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 10341000x800000000000000032029Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:26.231{50946567-2F52-60EC-2505-00000000DC01}26722712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072969Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:26.795{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a 10341000x800000000000000072968Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:26.795{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002 22542200x800000000000000072967Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.395{8057F119-21D0-60EC-6307-00000000DB01}7172analytics-collector-28944298.us-east-1.elb.amazonaws.com0100.26.82.72;3.224.104.154;3.215.161.145;52.201.0.254;C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000032028Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:26.091{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F52-60EC-2505-00000000DC01}2672C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032027Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:26.091{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 22542200x800000000000000072966Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.394{8057F119-21D0-60EC-6307-00000000DB01}7172collector.githubapp.com0type: 5 analytics-collector-28944298.us-east-1.elb.amazonaws.com;::ffff:52.201.0.254;::ffff:100.26.82.72;::ffff:3.224.104.154;::ffff:3.215.161.145;C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000032026Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:26.091{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032025Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:26.091{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 22542200x800000000000000072965Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.394{8057F119-21D0-60EC-6307-00000000DB01}7172avatars.githubusercontent.com0185.199.110.133;185.199.111.133;185.199.108.133;185.199.109.133;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000072964Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.393{8057F119-21D0-60EC-6307-00000000DB01}7172github.githubassets.com0185.199.109.154;185.199.110.154;185.199.111.154;185.199.108.154;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000072963Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.392{8057F119-21D0-60EC-6307-00000000DB01}7172avatars.githubusercontent.com0::ffff:185.199.109.133;::ffff:185.199.110.133;::ffff:185.199.111.133;::ffff:185.199.108.133;C:\Program Files\Mozilla Firefox\firefox.exe 354300x800000000000000072962Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:25.271{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local61341- 10341000x800000000000000032024Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:26.091{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000072961Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:25.196{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63306-false185.199.109.154cdn-185-199-109-154.github.com443https 354300x800000000000000072960Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:25.126{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63305-false10.0.1.12-8089- 354300x800000000000000072959Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:25.095{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63304-false185.199.109.154cdn-185-199-109-154.github.com443https 354300x800000000000000072958Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.937{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63303-false185.199.108.133cdn-185-199-108-133.github.com443https 354300x800000000000000072957Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.932{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63302-false185.199.109.154cdn-185-199-109-154.github.com443https 10341000x800000000000000032023Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:26.091{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000072956Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.920{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63301-false185.199.109.154cdn-185-199-109-154.github.com443https 10341000x800000000000000032022Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:26.091{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000072955Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.913{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63300-false185.199.109.154cdn-185-199-109-154.github.com443https 10341000x800000000000000032021Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:26.091{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032020Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:26.091{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032019Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:26.091{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000072954Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:24.524{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local65348- 23542300x800000000000000072953Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:26.089{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9E9FF19571611605536E08B7AF68DEB5,SHA256=D8E482BF315909BF68E7E41E4E63881FE8539AA3C0B36A0A67A611EBB95BC900,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000032018Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:26.091{50946567-0A80-60EC-0500-00000000DC01}416432C:\Windows\system32\csrss.exe{50946567-2F52-60EC-2505-00000000DC01}2672C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000032017Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:26.091{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F52-60EC-2505-00000000DC01}2672C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000032016Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:26.092{50946567-2F52-60EC-2505-00000000DC01}2672C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000032031Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:27.106{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2D9F61CF46DBB0C584E3D5B8156A7525,SHA256=3991FEAF957F746CD41853BB1A0F2E5BCD94919600B4104F9F289BBD4D9450EE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032030Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:27.075{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4AE2DF17070D94D8A5DF8B299DBD89E4,SHA256=ED0161390463D8585939655D51FF23AD35A2E49715B12B67999992A41E7C176F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072987Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:27.340{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000072986Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:27.340{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 10341000x800000000000000072985Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:27.244{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a 10341000x800000000000000072984Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:27.244{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002 10341000x800000000000000072983Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:27.187{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072982Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:27.186{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072981Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:27.177{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072980Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:27.172{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000072979Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:27.104{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9CED915CFE7F18AA31CC2AD111E4C0A6,SHA256=22D4907C7ECE6C5FD22C9B300570DC3205C8DE2E8FB64BD298976FE1CBAA4DFF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000072978Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:27.021{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032059Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.903{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F54-60EC-2705-00000000DC01}2068C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032058Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.903{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032057Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.903{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032056Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.903{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032055Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.903{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032054Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.903{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032053Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.903{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032052Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.903{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032051Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.903{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032050Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.903{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032049Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.903{50946567-0A80-60EC-0500-00000000DC01}4161044C:\Windows\system32\csrss.exe{50946567-2F54-60EC-2705-00000000DC01}2068C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000032048Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.903{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F54-60EC-2705-00000000DC01}2068C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000032047Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.904{50946567-2F54-60EC-2705-00000000DC01}2068C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000032046Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.403{50946567-2F54-60EC-2605-00000000DC01}29603128C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032045Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.231{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F54-60EC-2605-00000000DC01}2960C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032044Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.231{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032043Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.231{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032042Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.231{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032041Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.231{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032040Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.231{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032039Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.231{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032038Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.231{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032037Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.231{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032036Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.231{50946567-0A80-60EC-0500-00000000DC01}416432C:\Windows\system32\csrss.exe{50946567-2F54-60EC-2605-00000000DC01}2960C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000032035Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.231{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032034Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.231{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F54-60EC-2605-00000000DC01}2960C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000032033Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.232{50946567-2F54-60EC-2605-00000000DC01}2960C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000032032Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:28.169{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EE739CA51F7A519239AA447B8F7CC27B,SHA256=2903797E9CF06A0D4969257C7784FA6D33041E3285347B4AF011C98E6D908BC1,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073010Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.684{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d8d317|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede 10341000x800000000000000073009Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.684{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002 10341000x800000000000000073008Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.647{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000073007Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.647{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 10341000x800000000000000073006Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.587{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073005Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.555{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073004Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.553{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a 10341000x800000000000000073003Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.552{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002 10341000x800000000000000073002Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.530{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073001Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.527{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073000Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.524{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072999Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.524{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072998Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.503{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072997Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.499{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072996Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.496{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072995Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.495{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072994Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.303{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000072993Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.300{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a 10341000x800000000000000072992Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.300{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002 10341000x800000000000000072991Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.279{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000072990Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:25.338{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63307-false3.224.104.154ec2-3-224-104-154.compute-1.amazonaws.com443https 354300x800000000000000072989Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:25.275{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63308-false140.82.121.6lb-140-82-121-6-fra.github.com443https 23542300x800000000000000072988Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:28.111{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=339DD7EA79B55800A4398B072844635A,SHA256=EF47C686FC5C189E5ACD3B344DDB30B7AD25CB7ABFB2EFDA136051871211D630,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032061Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:29.387{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=201650B241DE2A053086C84F918616B4,SHA256=B13AC551848C3505D50FF6693F8EB5B119481CFEEE9DE4C2D752081D16D78DE8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032060Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:29.387{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=83D6BBCD7AF428E251217D1922E677EF,SHA256=44871E77E03717D74FD610A31262E3D301F0FDA25AF122821F53DDEC2E405BFB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073023Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:29.860{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073022Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:29.829{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073021Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:29.829{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073020Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:29.804{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073019Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:29.797{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a 10341000x800000000000000073018Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:29.797{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002 10341000x800000000000000073017Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:29.763{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000073016Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:29.763{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 10341000x800000000000000073015Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:29.635{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a 10341000x800000000000000073014Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:29.635{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002 23542300x800000000000000073013Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:29.383{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Local\Mozilla\Firefox\Profiles\ugslyq49.default-release\cache2\doomed\8081MD5=3D874CB9320DE03C0089699A312018CE,SHA256=77AFEC6BC0736D9F581B9377BC220A0704DD815FE60A412EF01B20185339AF08,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073012Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:29.382{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Local\Mozilla\Firefox\Profiles\ugslyq49.default-release\cache2\doomed\16183MD5=5123BCFAFE93B40AFA2D2B6EC55C8680,SHA256=66275FF620150294B292B610A1EDECF7BD0EFBF4656E28EFD037691BBE246362,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073011Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:29.130{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B95F559DD111ABAC55609AD000E86C11,SHA256=20276B8B846ACB9E444BC34DA9F2A03B29647B702023C9A85F0D050DED5914AB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032063Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:30.434{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D513AA2F217BC64976DA1D9DFD3D6DD1,SHA256=DE4D61D11620FCAAAAFA868FBFAF1F0DD0BE9CF95392ED28BE0556ABDDB1B6F3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073030Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:30.339{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073029Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:30.308{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000073028Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:30.140{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1F29879749D91478247CE27C7B90DA14,SHA256=90A26A602D3FF1326FE78C6EDF013515E935A5BFAF8FAFEF2CE28BFA8AA7B720,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000032062Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:27.586{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51559-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000073027Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:30.056{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073026Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:30.056{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073025Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:30.044{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073024Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:30.038{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000032064Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:31.528{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EEB854D2D3F0FE882A0CB1A4944567F6,SHA256=7FB7293B7A7BF4C1DE2ACF2253B5BB820C338D0D7BF5A49DFAEBF857BA241478,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073032Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:31.145{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B599981801A522D8C0B428CCECDF4D87,SHA256=942C319DDE11D02C113752714728455840EFF866DC97A1D837F5515E1A682E31,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073031Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:29.324{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63309-false10.0.1.12-8000- 23542300x800000000000000032065Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:32.575{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=93DA5ADEB32F5DED7C928C5B56B9583D,SHA256=8B8A24BE79AAC6ADCBA72821DFFCB0BB2551BB00D5E078720B69684600676204,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073033Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:32.149{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=305905AC1744BEC0552C5364F9C94296,SHA256=5F1B3A1957CA8FE0C0BDC83D9C4B20338D38C5EED7EC00CC1A9EC08A877F86A4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032066Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:33.797{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0FE01D3BD9FDAB659DD5E3B9ADF0C911,SHA256=B7731DF3AC5E08E20902C6933CA3A7533253F148F54C8C28A99D6E8C3FB8A6CF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073034Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.156{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E3750381E0909E327366FA48C0EC93C1,SHA256=4FE40B71A6906E55F5210A0F6AD953F937203A5D7DEC1DD4E43DAE86F7F8E92A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032067Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:34.828{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=86CB0557DA6E5696546C88C260A299A9,SHA256=498C62EE40501C26635CCBD74F1E4BC019A59F8BB52277739FA6283B182542BF,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073069Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.639{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local49406- 354300x800000000000000073068Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.637{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local65481- 354300x800000000000000073067Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.637{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63830- 354300x800000000000000073066Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.636{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local64511- 354300x800000000000000073065Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.630{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local57752- 354300x800000000000000073064Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.629{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local58535- 354300x800000000000000073063Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.628{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64766- 354300x800000000000000073062Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.626{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64970- 354300x800000000000000073061Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.625{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local58630- 354300x800000000000000073060Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.624{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local58241- 354300x800000000000000073059Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.623{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local59362- 354300x800000000000000073058Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.622{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local63499- 354300x800000000000000073057Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.621{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64890- 354300x800000000000000073056Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.620{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local62174- 354300x800000000000000073055Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.620{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local62341- 354300x800000000000000073054Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.619{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local55828- 354300x800000000000000073053Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.618{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64894- 354300x800000000000000073052Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.618{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local59891- 354300x800000000000000073051Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.617{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local54716- 354300x800000000000000073050Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.616{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local56794- 354300x800000000000000073049Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.615{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local56498- 354300x800000000000000073048Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.614{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63052- 354300x800000000000000073047Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.613{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local54316- 354300x800000000000000073046Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.613{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local65481- 354300x800000000000000073045Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.611{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local59634- 354300x800000000000000073044Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.611{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMudptruefalse10.0.1.14win-dc-89.attackrange.local59634-false10.0.1.14win-dc-89.attackrange.local53domain 354300x800000000000000073043Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.611{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local54733- 354300x800000000000000073042Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.611{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMudptruetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local54733-true0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domain 354300x800000000000000073041Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.603{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63311-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local49666- 354300x800000000000000073040Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.603{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63311-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local49666- 354300x800000000000000073039Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.602{8057F119-08A1-60EC-0D00-00000000DB01}896C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63310-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local135epmap 354300x800000000000000073038Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.602{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63310-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local135epmap 23542300x800000000000000073037Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:34.487{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8F2779A2FBB58F24C45EEDF29A3D1CAF,SHA256=AE006B7DA8683A56796CA1CB3D5C354DEFDACE0A536E2EC8FF0CCBAFAF90CE1B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073036Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:34.486{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=11C7F6CD2DEDE6B0E2E4B18C565E4DFF,SHA256=797A5807602DC14B97D024FC7355A85927833E656A3D90E31E4D4A5D26ED9BFB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073035Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:34.161{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=16DBF0E9E51C88FB3FFC942F1A1B65FC,SHA256=23ED3EAE7877D7B2FCAA70A088594C9FD323151DCCE3F5C708BB3B6ACE16BF59,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032069Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:35.844{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E2ED48DC5BC8387299A7B393B899955,SHA256=D521FB9FC304EB29D6DC798D6485706B353CBB7D8B9DAD4CC5ED283C74835BBA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073079Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:35.523{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F4FCFC8EF82013A105AB92E0AACDBD1A,SHA256=B4F6DC9178686D9F698D2FDA16836A63964087B5F2B4393BEBCE23AE6E5FEA41,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000032068Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:33.417{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51560-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000073078Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.651{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64020- 354300x800000000000000073077Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.649{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local54843- 354300x800000000000000073076Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.648{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64488- 354300x800000000000000073075Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.646{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local56240- 354300x800000000000000073074Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.645{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local64083- 354300x800000000000000073073Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.645{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local62539- 354300x800000000000000073072Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.644{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local59525- 354300x800000000000000073071Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.642{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local65298- 354300x800000000000000073070Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.642{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local56322- 23542300x800000000000000032070Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:36.859{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C96F6C7F75AFFE16BD675424237D806D,SHA256=AEA5E3DE27F54B4CCECE08E4758EE62F475954B884C3975AAE5829191E731ADE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073082Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:36.531{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3BCB3B989836DBC687B84AAD19D6F586,SHA256=5320EB31861435EF8E54E7171FBF7574CA92292B4E3C4A3A434B83C79156F8B1,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073081Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.654{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-89.attackrange.local53domainfalse10.0.1.14win-dc-89.attackrange.local56856- 354300x800000000000000073080Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:33.653{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local55467- 23542300x800000000000000032071Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:37.875{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B63E50CA41E06AB6F933C9FA0D1C25AF,SHA256=0DE9EE182A76E84C9165D7799F8C4A0A0205F13F9C7CFD8AA11781D2F37C13BA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073084Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:37.537{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3FD16B733573810452676EA3B8F9ED54,SHA256=AC0E866E93E1894A9E1AC72BA0FCC883D14B10B51E8DBC5B2F435374F94BDF3D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073083Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:35.226{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63312-false10.0.1.12-8000- 23542300x800000000000000032072Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:38.891{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=910828B82E6005A34CC608D046864694,SHA256=7615ECD6445CCE2EDCD2B23716ABB2D7794DEB0C3B04E6FB49BB2C7B7C12D83C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073085Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:38.557{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DB06AEAFBBCD65F1FB017B25E561681E,SHA256=21898809EFD0830C5B1A07C9637E8C3C83B6A307597548646A797E56AB3DB4EE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032073Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:39.906{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8AAF77F429ECC36BE1461A18C3C0B717,SHA256=9FB293FF6CD4807E313CCEE899EB44BCC996842EDD74ED40216D3E563F723275,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073086Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:39.573{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5F9F409045A540B0C8FA3E74E85387A6,SHA256=69FAA566596E8C9065204E0BAD389102A1FFD437BB84F74F893B756D0CC86E5A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032075Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:40.922{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=67F2AE916BF492505F2DD9DA17463678,SHA256=E23C4FC9CFC3FBD74AA5639A85EA8A67319D4766777FC7CB522764EB9F34BCCB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073087Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:40.590{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=75796F8A39067FE3AC4945B98036B758,SHA256=EFC008B0C3253924CA64DDD149430ED31CB81C51FCEE2060E08770569E6805ED,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000032074Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:38.558{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51561-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000032076Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:41.938{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C6DD51617753DB0A3DEC0659437F09E6,SHA256=91116B12B1D5BC02C6F2D162EF2F4017D10A4042E4FB3ABBEACB730707A2E918,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073088Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:41.616{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=36B66C7A9937959412CA575CD2B620A1,SHA256=F76FB34E3BB510C2828C1AC96AEA02D6263BA85CE71DD67A703AC95DD9E98C4F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032077Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:42.953{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F54BCF11F430EBF51C907988B085B7BC,SHA256=0DDAA770C823579B283D50280D15DD1A6531A722CC9E983DDCBAACACCDA56A0E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073093Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:42.621{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=01FB92BFBE29D16F3F6EAD4CC3FAE873,SHA256=AB5E86F8773CF7C76F96B94DA71E2EB65F8EFA82A7317434C5615D9D0458728A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073092Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:42.396{8057F119-08A1-60EC-0D00-00000000DB01}8965648C:\Windows\system32\svchost.exe{8057F119-2DF7-60EC-C009-00000000DB01}5288C:\Windows\SysWOW64\mshta.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073091Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:42.396{8057F119-08A1-60EC-0D00-00000000DB01}8965648C:\Windows\system32\svchost.exe{8057F119-2DF7-60EC-C009-00000000DB01}5288C:\Windows\SysWOW64\mshta.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073090Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:42.396{8057F119-08A1-60EC-0D00-00000000DB01}8965648C:\Windows\system32\svchost.exe{8057F119-2DF7-60EC-C009-00000000DB01}5288C:\Windows\SysWOW64\mshta.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000073089Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:40.322{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63313-false10.0.1.12-8000- 23542300x800000000000000032078Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:43.969{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=772309EA23F092E2159E765AA573B90D,SHA256=121CDB848094295F63DA3D9970F0D3690ED6187701E10DB71C43DBEF56771636,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073094Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:43.639{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D177E058B72F8C771A5D740ED533B056,SHA256=E33A8BF27794175C7DA5328C2B0821D4082EAD52B03CD5AF4C1389DEE16AE4E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032079Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:44.984{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FB850D2A843796A16CDD0DC127D243F9,SHA256=870321CFBE9B89D00E6E18C9D9B26DD13D0B97AE3697C167AA9CCF077FA88D3D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073095Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:44.643{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ABF50BF90AFE086F78F723E8962EEBDA,SHA256=418C590551C3478A3E11F4661F9613C221FFC0F49FABB389E1E167FB55F6052E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073096Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:45.665{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5E4197A52111211F7ECB99055F0D316B,SHA256=AA9E4C7B8EE2D28FD2B99C1A445EDF482E8BA144E831F817B40E21CEC477472E,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073201Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:45.364{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63314-false10.0.1.12-8000- 23542300x800000000000000073200Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.864{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C939A1A756092FE7BD85606B47240877,SHA256=5E84387650EAA6D68BA10995FBD91FA53608AA76A981DECACD248F103D8AD552,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000073199Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.749{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000073198Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.749{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000073197Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.749{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000073196Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.749{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000073195Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.749{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000073194Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.749{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000073193Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.749{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000073192Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.749{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000073191Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.749{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000073190Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.743{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000073189Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.743{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000073188Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.743{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000073187Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.743{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000073186Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.742{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000073185Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.742{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000073184Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.742{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000073183Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.742{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000073182Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000073181Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000073180Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000073179Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000073178Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000073177Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000073176Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000073175Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000073174Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000073173Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000073172Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000073171Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000073170Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000073169Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000073168Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000073167Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000073166Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000073165Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000073164Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000073163Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073162Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000073161Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000073160Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000073159Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000073158Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073157Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073156Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073155Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073154Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-089E-60EC-0500-00000000DB01}412436C:\Windows\system32\csrss.exe{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000073153Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.727{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000073152Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.728{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000032080Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:46.000{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=87234559EC92A06EFF7A56028466FBB0,SHA256=650F3AF8681A2D8D3C7E194FCAA83C6B1471E91B8BB41746FE8C6133B0B2CC83,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000073151Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.248{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000073150Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.248{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000073149Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.248{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000073148Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000073147Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000073146Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.064{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000073145Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.064{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000073144Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.064{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000073143Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.064{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000073142Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.064{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000073141Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.064{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000073140Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.064{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000073139Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.064{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000073138Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000073137Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000073136Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000073135Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000073134Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000073133Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000073132Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000073131Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000073130Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000073129Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000073128Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000073127Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000073126Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000073125Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000073124Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000073123Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000073122Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000073121Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000073120Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000073119Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000073118Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000073117Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000073116Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000073115Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000073114Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000073113Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000073112Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000073111Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000073110Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000073109Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.049{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 10341000x800000000000000073108Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.048{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073107Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.048{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000073106Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.047{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000073105Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.047{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000073104Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.046{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 10341000x800000000000000073103Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.046{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073102Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.046{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073101Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.046{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073100Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.046{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073099Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.046{8057F119-089E-60EC-0500-00000000DB01}412428C:\Windows\system32\csrss.exe{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000073098Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.045{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000073097Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.044{8057F119-2F66-60EC-EF09-00000000DB01}9500C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000073259Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.880{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CDBBC5FA47E05F04C5CF2EB749EC2E34,SHA256=8DA5E91FCFD4423871F7C032A5C72C145C5BEE565F8A0F33B9A16CBB2EC7E436,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000032082Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:44.417{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51562-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000032081Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:47.016{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9B9F717BCF74E869194F5A7C4CAB9DEE,SHA256=C483A6F7D814FBB0C7D99226F0E3555C8AFD941CAE65DD7F6E85B482E928E4D5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073258Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.680{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C1CC243537CDBB96395679306B873B33,SHA256=D852C3AA90644FB384D59C2209174328B543828C520B2FA716C51CC8B42F12A2,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000073257Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.664{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000073256Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.664{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000073255Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.664{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000073254Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.427{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000073253Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.427{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000073252Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.427{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000073251Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.427{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000073250Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.427{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000073249Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.427{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000073248Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.427{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000073247Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.427{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000073246Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.411{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000073245Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.411{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000073244Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.411{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000073243Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.411{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000073242Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.411{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000073241Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.411{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000073240Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.411{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000073239Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.411{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000073238Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.411{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000073237Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.411{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000073236Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.411{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000073235Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.411{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000073234Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.411{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000073233Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.411{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000073232Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.411{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000073231Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000073230Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000073229Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000073228Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000073227Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000073226Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000073225Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000073224Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000073223Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000073222Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000073221Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000073220Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 10341000x800000000000000073219Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073218Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073217Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073216Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073215Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000073214Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073213Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000073212Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000073211Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000073210Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 10341000x800000000000000073209Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-089E-60EC-0500-00000000DB01}412436C:\Windows\system32\csrss.exe{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000073208Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.395{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000073207Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.397{8057F119-2F67-60EC-F109-00000000DB01}10180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000073206Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.064{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1CDABE477537F56533769C42AA54CB47,SHA256=E3E29AB1B5CBF6BDB2FD2983871855F3ABAAEDB85CDEBA3EA86487D0A65FC74D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073205Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:47.064{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8F2779A2FBB58F24C45EEDF29A3D1CAF,SHA256=AE006B7DA8683A56796CA1CB3D5C354DEFDACE0A536E2EC8FF0CCBAFAF90CE1B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073204Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.996{8057F119-2F66-60EC-F009-00000000DB01}87365056C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073203Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.996{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000073202Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:46.996{8057F119-2F66-60EC-F009-00000000DB01}8736C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000073261Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:48.880{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7EB1F8D276C846DD43C0F0CC46E59D80,SHA256=F140774C6025B268258E4D43423CC2B1638038187A25E9162EC43E88B31E43F8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032083Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:48.016{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=02137A70CA43CE6DE397F4ABF1CD1142,SHA256=B47E2D184AE85749DA1912FF6C831AAF2393B58BCF9C1CEB7AEBC3772B49859F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073260Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:48.396{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1CDABE477537F56533769C42AA54CB47,SHA256=E3E29AB1B5CBF6BDB2FD2983871855F3ABAAEDB85CDEBA3EA86487D0A65FC74D,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000073317Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.668{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000073316Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.668{8057F119-2F69-60EC-F209-00000000DB01}24164604C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073315Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.668{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000073314Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.668{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 10341000x800000000000000073313Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.549{8057F119-21D0-60EC-6307-00000000DB01}71726772C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+1549f7|C:\Windows\System32\windows.storage.dll+154323|C:\Windows\System32\windows.storage.dll+1541a9|C:\Windows\System32\windows.storage.dll+27be5|C:\Windows\System32\windows.storage.dll+27b2d|C:\Windows\System32\windows.storage.dll+26076|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6520c|C:\Windows\System32\combase.dll+64ec2|C:\Windows\System32\combase.dll+63798|C:\Windows\System32\combase.dll+61c3f|C:\Windows\System32\combase.dll+60c3f|C:\Windows\System32\combase.dll+5e336|C:\Windows\System32\combase.dll+5daea|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000073312Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.549{8057F119-21D0-60EC-6307-00000000DB01}71726772C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+154962|C:\Windows\System32\windows.storage.dll+154323|C:\Windows\System32\windows.storage.dll+1541a9|C:\Windows\System32\windows.storage.dll+27be5|C:\Windows\System32\windows.storage.dll+27b2d|C:\Windows\System32\windows.storage.dll+26076|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6520c|C:\Windows\System32\combase.dll+64ec2|C:\Windows\System32\combase.dll+63798|C:\Windows\System32\combase.dll+61c3f|C:\Windows\System32\combase.dll+60c3f|C:\Windows\System32\combase.dll+5e336|C:\Windows\System32\combase.dll+5daea|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000073311Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.549{8057F119-21D0-60EC-6307-00000000DB01}71726772C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+154947|C:\Windows\System32\windows.storage.dll+154323|C:\Windows\System32\windows.storage.dll+1541a9|C:\Windows\System32\windows.storage.dll+27be5|C:\Windows\System32\windows.storage.dll+27b2d|C:\Windows\System32\windows.storage.dll+26076|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6520c|C:\Windows\System32\combase.dll+64ec2|C:\Windows\System32\combase.dll+63798|C:\Windows\System32\combase.dll+61c3f|C:\Windows\System32\combase.dll+60c3f 10341000x800000000000000073310Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.549{8057F119-21D0-60EC-6307-00000000DB01}71726772C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+154947|C:\Windows\System32\windows.storage.dll+154323|C:\Windows\System32\windows.storage.dll+1541a9|C:\Windows\System32\windows.storage.dll+27be5|C:\Windows\System32\windows.storage.dll+27b2d|C:\Windows\System32\windows.storage.dll+26076|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6520c|C:\Windows\System32\combase.dll+64ec2|C:\Windows\System32\combase.dll+63798|C:\Windows\System32\combase.dll+61c3f|C:\Windows\System32\combase.dll+60c3f|C:\Windows\System32\combase.dll+5e336 23542300x800000000000000073309Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.549{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms~RF979646.TMPMD5=63DB820E40DEE151E06A16DA8025FB39,SHA256=CA1203CD054940171195A401EC651D0BD1F09A23CDA9BF1AC36439D84FAB463F,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000073308Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.396{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000073307Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.396{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000073306Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.396{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000073305Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.380{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000073304Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.380{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000073303Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.380{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000073302Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.380{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000073301Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.380{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000073300Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.380{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000073299Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.380{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000073298Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000073297Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000073296Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000073295Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000073294Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000073293Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000073292Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000073291Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000073290Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000073289Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000073288Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000073287Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000073286Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000073285Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000073284Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000073283Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000073282Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000073281Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000073280Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000073279Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000073278Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000073277Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000073276Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000073275Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000073274Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000073273Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073272Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000073271Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000073270Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000073269Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000073268Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073267Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073266Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073265Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073264Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-089E-60EC-0500-00000000DB01}412528C:\Windows\system32\csrss.exe{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000073263Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.365{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000073262Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.366{8057F119-2F69-60EC-F209-00000000DB01}2416C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000032084Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:49.031{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=94AE3FE952345DFF72CFA9A07960C292,SHA256=D4F245CC35968E7E33E5BAE954D4D05F94C21509EC4ACDEC3307A92C0A4BFBDA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032085Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:50.031{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1AA1CA4D44741C16E875E7B5D850CE1A,SHA256=0431140E06CBD673A8768DDA1D5C47E83937DD7D9030EF158F430E35E40A46EA,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000073424Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.931{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000073423Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.931{8057F119-2F6A-60EC-F409-00000000DB01}100086764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073422Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.931{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000073421Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.931{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000073420Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.849{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=734CF834F19901FA055F4A30B489174B,SHA256=1692E8C63B559DA97E712922169F3D26C7644C9B9184D22B89564FBE79016034,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000073419Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.731{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000073418Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.731{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000073417Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.731{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000073416Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.731{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000073415Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.716{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000073414Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.716{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000073413Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.716{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000073412Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.716{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000073411Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.716{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000073410Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.716{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000073409Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000073408Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000073407Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000073406Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000073405Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000073404Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000073403Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000073402Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000073401Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000073400Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000073399Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000073398Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000073397Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000073396Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000073395Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000073394Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000073393Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000073392Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000073391Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000073390Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000073389Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000073388Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000073387Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000073386Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000073385Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000073384Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073383Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000073382Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000073381Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000073380Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000073379Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073378Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073377Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073376Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073375Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-089E-60EC-0500-00000000DB01}412528C:\Windows\system32\csrss.exe{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000073374Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.700{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000073373Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.701{8057F119-2F6A-60EC-F409-00000000DB01}10008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000073372Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.530{8057F119-08A1-60EC-0D00-00000000DB01}8965648C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2F00-00000000DB01}3068C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000073371Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.368{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=106C3BAA881A312A612EC8E05F93CEFA,SHA256=F1336AB24F5E37980769CDED860FA469188D4545D612502FCCEF2F7561CC03EF,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000073370Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.268{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000073369Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.268{8057F119-2F6A-60EC-F309-00000000DB01}94288776C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073368Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.268{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000073367Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.268{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000073366Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.183{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=47A630CE9A22403E050C4E7DF67A8176,SHA256=D06FA3486F2DA3D13071174680B367A5C6AD234A538F14DC60D5449BF7DC6AAB,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000073365Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.051{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000073364Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.051{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000073363Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.051{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000073362Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.051{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000073361Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.051{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000073360Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.051{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000073359Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.051{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000073358Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.051{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000073357Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000073356Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000073355Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000073354Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000073353Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000073352Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000073351Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000073350Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000073349Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000073348Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000073347Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000073346Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000073345Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000073344Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000073343Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000073342Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000073341Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000073340Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000073339Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000073338Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000073337Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000073336Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000073335Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000073334Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000073333Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000073332Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000073331Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000073330Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000073329Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073328Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000073327Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 10341000x800000000000000073326Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073325Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000073324Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073323Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 10341000x800000000000000073322Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073321Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073320Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-089E-60EC-0500-00000000DB01}412428C:\Windows\system32\csrss.exe{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000073319Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.030{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000073318Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:50.031{8057F119-2F6A-60EC-F309-00000000DB01}9428C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000032086Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:51.047{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BF1A4EC50117A26B99AD7CD6F0233702,SHA256=1E176C8F85EA0E4541B84BFFD767043BE99F875581C11B6FED08B14761496A27,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073428Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:51.701{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=182198AA1161B9BFE2870EC35F29B561,SHA256=0249E4DFADB097B50AB242D9B189F5323056E37EC41A353F6BA273E53B0CAA10,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073427Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:51.186{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=352688E11FFA116AC01DE6C8D0EF4B8B,SHA256=F544D41835CA0DB43142EAE7C1996123974E8A2B62F854C6C35C18BFB02CF42B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073426Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.835{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63315-true0:0:0:0:0:0:0:1win-dc-89.attackrange.local389ldap 354300x800000000000000073425Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:49.835{8057F119-08AE-60EC-2800-00000000DB01}2912C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63315-true0:0:0:0:0:0:0:1win-dc-89.attackrange.local389ldap 10341000x800000000000000073432Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:52.500{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08A1-60EC-1500-00000000DB01}1192C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073431Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:52.500{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08A1-60EC-1500-00000000DB01}1192C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073430Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:52.500{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08A1-60EC-1500-00000000DB01}1192C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000073429Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:52.169{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=59699EBF08E7A06C5DEB641F0E4205E8,SHA256=E66B6232D480173817B07B8360013A41B02A9E22EC40D167604DE44B038DB12B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032087Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:52.063{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1506AFFFB87F9DC6DFAB52774701C03A,SHA256=D671D4FA6C12251A4D4FDEB61D615CD69A7196E0B50BB1F5C7BE1410E074460C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073485Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.631{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A0EBCA0E9671B2B75F67BAC4CA62CCDE,SHA256=67BA5856E32DC83A2E7D1B33DA46ED8062E5B6F1593243EB92360C011D27BDCB,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000073484Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.443{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000073483Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.442{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000073482Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.441{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 354300x800000000000000073481Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:51.384{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63316-false10.0.1.12-8000- 354300x800000000000000032089Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:49.526{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51563-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000032088Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:53.078{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=84B81C016ED11D0DD0C9C4BAEED2ADE4,SHA256=6AD7ACF0BF168E8F3C74CDE653DBF22F535B5110D71A1CC50674E6C50BA669A5,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000073480Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.168{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000073479Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.168{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000073478Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.168{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000073477Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.168{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000073476Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.168{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000073475Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.168{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000073474Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.168{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000073473Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000073472Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000073471Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000073470Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000073469Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000073468Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000073467Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000073466Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000073465Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000073464Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000073463Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000073462Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000073461Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000073460Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000073459Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000073458Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000073457Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000073456Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000073455Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000073454Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000073453Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000073452Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000073451Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000073450Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000073449Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000073448Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000073447Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000073446Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000073445Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000073444Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.153{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073443Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.152{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000073442Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.151{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000073441Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.151{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000073440Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.151{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073439Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.151{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073438Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.151{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 10341000x800000000000000073437Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.150{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073436Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.150{8057F119-08A1-60EC-0C00-00000000DB01}8408984C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073435Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.150{8057F119-089E-60EC-0500-00000000DB01}412436C:\Windows\system32\csrss.exe{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000073434Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.149{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000073433Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:53.147{8057F119-2F6D-60EC-F509-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000073487Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:54.215{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=51766E5E90794C290F8D94049D9DAB39,SHA256=2FB425A7BEDA3C02DE4EEDDDB61F12BE1A090EF994A5F70A54A731B380E332DC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032090Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:54.079{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DB2AE0D07B2F92A5D569B9CA3C934C09,SHA256=1DE6B9A1F4E72D07F2D2E97A8BD1D1A88843EC4755A0F7EE3F65BD67F69AF3CA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073486Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:54.168{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A8873172BEF664FD5DFBC025F89DE8B3,SHA256=5FAA2D45399BAECD94ED73365BECA69F0EDA91FD62E0D3D4600296E7E1C4118C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073488Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:55.230{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=657523AC4FE60FDD16C65D1AFD5CE4F6,SHA256=F1461A62C0998D8EFF67E96D6DB1C4548DE713B8014B237250FD76684C54F875,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032091Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:55.095{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D4F4F069DD015D100EF5A00AEDBC2249,SHA256=AE8939DE7CC0A77C0509E3AAC31136C6D175FC3AD7A45B59E8221EA0DD934C39,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073489Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:56.231{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8CE2B81FECBB4AE73C81073B02A63388,SHA256=0EFAB129831E2C5ECA7F64249B37B05D3AB620452D8EC69B417FDFFC88ACA013,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032092Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:56.110{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B725F76D78B30103BDE39C59E76C5989,SHA256=E068540A1061AB2CB762E37A9F30A88E824D0651C07B01EF2C0543866B87338C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032093Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:57.126{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC087E19028F2C6247E5CE570322055C,SHA256=0CFA8E5E2C0268947136F581F8F2E06F16A9CDCD7EE022897ED4EEA03A49B353,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073497Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:57.251{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=755963B6A62D50CBF9236A16961324A4,SHA256=A767BF62EC78C73D810F77BE1B7147C1328E1BA4332C26132ABB522713006376,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073496Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:57.148{8057F119-21BD-60EC-4B07-00000000DB01}58806200C:\Windows\Explorer.EXE{8057F119-2DED-60EC-B409-00000000DB01}8628C:\Windows\system32\cmd.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+61d9f|C:\Windows\System32\SHELL32.dll+62945|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7b7ef|C:\Windows\System32\windows.storage.dll+7a56f|C:\Windows\System32\windows.storage.dll+7d51f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073495Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:57.148{8057F119-21BD-60EC-4B07-00000000DB01}58806200C:\Windows\Explorer.EXE{8057F119-2DED-60EC-B409-00000000DB01}8628C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6285e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7b7ef|C:\Windows\System32\windows.storage.dll+7a56f|C:\Windows\System32\windows.storage.dll+7d51f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073494Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:57.147{8057F119-21BD-60EC-4B07-00000000DB01}58806200C:\Windows\Explorer.EXE{8057F119-2DED-60EC-B409-00000000DB01}8628C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+61724|C:\Windows\System32\SHELL32.dll+62827|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7b7ef|C:\Windows\System32\windows.storage.dll+7a56f|C:\Windows\System32\windows.storage.dll+7d51f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073493Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:57.130{8057F119-21BD-60EC-4B07-00000000DB01}58805064C:\Windows\Explorer.EXE{8057F119-2DED-60EC-B509-00000000DB01}9916C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+61d9f|C:\Windows\System32\SHELL32.dll+622c0|C:\Windows\System32\TwinUI.dll+12d491|C:\Windows\System32\TwinUI.dll+12df7f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073492Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:57.130{8057F119-21BD-60EC-4B07-00000000DB01}58805064C:\Windows\Explorer.EXE{8057F119-2DED-60EC-B509-00000000DB01}9916C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+47c90|C:\Windows\System32\SHELL32.dll+6227c|C:\Windows\System32\TwinUI.dll+12d491|C:\Windows\System32\TwinUI.dll+12df7f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073491Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:57.130{8057F119-21BD-60EC-4B07-00000000DB01}58805064C:\Windows\Explorer.EXE{8057F119-2DED-60EC-B509-00000000DB01}9916C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+61724|C:\Windows\System32\SHELL32.dll+62250|C:\Windows\System32\TwinUI.dll+12d491|C:\Windows\System32\TwinUI.dll+12df7f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073490Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:57.130{8057F119-21BD-60EC-4B07-00000000DB01}58805064C:\Windows\Explorer.EXE{8057F119-2DED-60EC-B509-00000000DB01}9916C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+12d2c9|C:\Windows\System32\TwinUI.dll+12df7f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000032095Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:58.376{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88E8F19024D9938C113C6BCC3EDA3D07,SHA256=FD9E485E927C802230A118B426A5B60DE5248E2B1D461DE732BC26A65AD931F3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073571Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.266{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6D4AC6996A1049C0CC5AA8EF5137050A,SHA256=6ED81152D3D5DF27F930E99E8A30B920AE23E14B89309C0349FD33F3863462B5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000032094Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:55.480{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51564-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000073570Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.213{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6382062A29493E9180B9A4DCEAB39F7B,SHA256=C3ED31C81E06AEE191EDC22CA391CEDAB85AF63DAF788323A55DBBD593700757,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073569Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073568Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073567Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073566Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073565Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073564Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073563Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073562Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073561Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073560Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073559Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073558Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073557Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073556Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073555Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073554Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073553Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073552Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073551Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073550Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073549Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073548Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073547Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073546Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073545Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073544Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073543Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073542Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21BD-60EC-4B07-00000000DB01}5880C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073541Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073540Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073539Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073538Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073537Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073536Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073535Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073534Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073533Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073532Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073531Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073530Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073529Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073528Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073527Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073526Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073525Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073524Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073523Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073522Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1973-60EC-0206-00000000DB01}1608C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073521Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1980-60EC-1106-00000000DB01}2848C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073520Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1980-60EC-1106-00000000DB01}2848C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073519Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-1980-60EC-1106-00000000DB01}2848C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073518Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-197E-60EC-1006-00000000DB01}4880C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073517Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-197E-60EC-1006-00000000DB01}4880C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073516Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-197E-60EC-1006-00000000DB01}4880C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073515Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-197E-60EC-1006-00000000DB01}4880C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073514Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-197E-60EC-1006-00000000DB01}4880C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073513Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-197E-60EC-1006-00000000DB01}4880C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073512Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-197E-60EC-1006-00000000DB01}4880C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073511Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-197E-60EC-1006-00000000DB01}4880C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073510Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21C2-60EC-5907-00000000DB01}500C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073509Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21C2-60EC-5907-00000000DB01}500C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073508Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21C2-60EC-5907-00000000DB01}500C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073507Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2F00-00000000DB01}3068C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073506Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2F00-00000000DB01}3068C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073505Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21C1-60EC-5807-00000000DB01}4480C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073504Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21C1-60EC-5807-00000000DB01}4480C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073503Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21C1-60EC-5807-00000000DB01}4480C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073502Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21C1-60EC-5807-00000000DB01}4480C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073501Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21C1-60EC-5807-00000000DB01}4480C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073500Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21C1-60EC-5807-00000000DB01}4480C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073499Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21C1-60EC-5807-00000000DB01}4480C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073498Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:58.082{8057F119-08A1-60EC-0D00-00000000DB01}896916C:\Windows\system32\svchost.exe{8057F119-21C1-60EC-5807-00000000DB01}4480C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000032096Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:02:59.501{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=21B6590523BD0D9772B8D0C430954894,SHA256=9FE1879348F9AB166000395206462350F76225C797AA399F4F58B3A7BBF02650,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073573Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:59.281{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=926365BC85AA0D30C9F8008E0AFA498F,SHA256=51C3C8B7AA6F5DDE3CC0D4DCA39919C1C987900978910FFA278C970C181FF14D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073572Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:02:57.381{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63317-false10.0.1.12-8000- 23542300x800000000000000032097Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:00.674{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D186B6901709A6779DBDCE7593B32EA3,SHA256=3746FB0E9F9606B5642B36FBBA223290602899F0C092B611AFC3882C89942F61,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073574Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:00.301{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0D3965D3E7484928B339C8375A4A31ED,SHA256=890E43DC78295B1F993AB641278A52090D26EBD7458D6D3E7C28E4CEA94BA7D7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032098Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:01.723{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1DA36EC3C3F2B3DC486C1C748D24DF28,SHA256=EE24AC87B7DDEE2F30622E4D5AF3E5520F6B7823A6BC1793552F8ED6228BE053,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073582Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:01.517{8057F119-21BD-60EC-4B07-00000000DB01}58806200C:\Windows\Explorer.EXE{8057F119-2DED-60EC-B409-00000000DB01}8628C:\Windows\system32\cmd.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+61d9f|C:\Windows\System32\SHELL32.dll+62945|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7b7ef|C:\Windows\System32\windows.storage.dll+7a56f|C:\Windows\System32\windows.storage.dll+7d51f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073581Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:01.517{8057F119-21BD-60EC-4B07-00000000DB01}58806200C:\Windows\Explorer.EXE{8057F119-2DED-60EC-B409-00000000DB01}8628C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6285e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7b7ef|C:\Windows\System32\windows.storage.dll+7a56f|C:\Windows\System32\windows.storage.dll+7d51f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073580Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:01.517{8057F119-21BD-60EC-4B07-00000000DB01}58806200C:\Windows\Explorer.EXE{8057F119-2DED-60EC-B409-00000000DB01}8628C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+61724|C:\Windows\System32\SHELL32.dll+62827|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7b7ef|C:\Windows\System32\windows.storage.dll+7a56f|C:\Windows\System32\windows.storage.dll+7d51f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073579Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:01.501{8057F119-21BD-60EC-4B07-00000000DB01}58805064C:\Windows\Explorer.EXE{8057F119-2DED-60EC-B509-00000000DB01}9916C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+61d9f|C:\Windows\System32\SHELL32.dll+622c0|C:\Windows\System32\TwinUI.dll+12d491|C:\Windows\System32\TwinUI.dll+12df7f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073578Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:01.501{8057F119-21BD-60EC-4B07-00000000DB01}58805064C:\Windows\Explorer.EXE{8057F119-2DED-60EC-B509-00000000DB01}9916C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+47c90|C:\Windows\System32\SHELL32.dll+6227c|C:\Windows\System32\TwinUI.dll+12d491|C:\Windows\System32\TwinUI.dll+12df7f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073577Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:01.501{8057F119-21BD-60EC-4B07-00000000DB01}58805064C:\Windows\Explorer.EXE{8057F119-2DED-60EC-B509-00000000DB01}9916C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+61724|C:\Windows\System32\SHELL32.dll+62250|C:\Windows\System32\TwinUI.dll+12d491|C:\Windows\System32\TwinUI.dll+12df7f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073576Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:01.501{8057F119-21BD-60EC-4B07-00000000DB01}58805064C:\Windows\Explorer.EXE{8057F119-2DED-60EC-B509-00000000DB01}9916C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+12d2c9|C:\Windows\System32\TwinUI.dll+12df7f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000073575Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:01.316{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4AE6CD99509468C12F34CF6C72FCAF19,SHA256=363CBC0510D5F64AFBD6F2E97032ACAA01C056A3C64EF613B4B2793EB836D85E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032099Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:02.756{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5395BC74547E8A41A29806A4602CBE80,SHA256=2008AA2922FB17895A50F46992872A6A2CC625DD76217C315329E78BCBD74C05,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073583Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:02.316{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7E5008EABDDB504C572597DC9743318C,SHA256=000F68AFAB327FFFF0087574188CA27A4E7C34D673D31C89DB3B9D91FA520F61,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032102Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:03.881{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=447471DA2B8D9736C8345998962BC316,SHA256=ABECA4CB1C359C3A9BDEB6BAB3C9F3658E5DA4B8E98C884D1C63F0C1327E7F60,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073584Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:03.349{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=50A3C374F986FAB1671493AA1EF3C9E3,SHA256=87EEF147BBA9A0E6289F2FF1B3779BBDA934055478890B70C6187AA01D38EE4D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000032101Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:00.483{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51565-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000032100Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:03.069{50946567-0AF3-60EC-9E00-00000000DC01}3556NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=A52F6585761A8E82F695C029A0DE8E39,SHA256=23013549159043F148E7F54E2980270BD42A6AB4C4FA368424ACDA42C74194F9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073586Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:04.368{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=90D87CC399798E3069737A8A7A8D4D48,SHA256=470D3FE2C903C3059F265E57123C73FBA581599469AA351657AF901A0CB71B4D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073585Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:03.282{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63318-false10.0.1.12-8000- 354300x800000000000000032103Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:02.407{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51566-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000073587Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:05.382{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC797A8EF5E48B1B389D9EFFA5C2853F,SHA256=996457B1C7FA2A4908AA14DCC9F6A9A47FD66482C97F3E261111B5DC6B2AC90D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032104Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:05.100{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5F281A23D67B4EB1056428A2CA26885A,SHA256=D0B56B54858A4548D146865F258A0799255B380A7580B551DFFD37BB98061DD4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073588Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:06.397{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D6E600BA962318BC70F3A709876B6B1C,SHA256=21EBAC1AD7BDCE4EE20AE60C0C9CB48488DB540FBA2BCEA20BE82027C64D8D83,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000032106Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:04.469{50946567-0A81-60EC-1100-00000000DC01}972C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruetruefe80:0:0:0:2c0c:3cc4:f5ff:fef0win-host-439546dhcpv6-clienttrueff02:0:0:0:0:0:1:2-547dhcpv6-server 23542300x800000000000000032105Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:06.194{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=831D767713DD6D827244C737810FD047,SHA256=8B1EB8A3ACB5B7EFD6665D4C443C0E79F041BD69CD655E9F540697CB4F493B07,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000073604Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-SetValue2021-07-12 12:03:07.981{8057F119-08AE-60EC-2A00-00000000DB01}2932C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Volumes\2F5B0B75-0000-0000-0000-100000000000\Volume Configuration File\\.\C:\System Volume Information\DFSR\Config\Volume_2F5B0B75-0000-0000-0000-100000000000.XML 13241300x800000000000000073603Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-SetValue2021-07-12 12:03:07.981{8057F119-08AE-60EC-2A00-00000000DB01}2932C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\A48E1583-94F8-4700-B651-E79BB21ACBC2\Config SourceDWORD (0x00000001) 13241300x800000000000000073602Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-SetValue2021-07-12 12:03:07.981{8057F119-08AE-60EC-2A00-00000000DB01}2932C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\A48E1583-94F8-4700-B651-E79BB21ACBC2\Replica Set Configuration File\\?\C:\System Volume Information\DFSR\Config\Replica_A48E1583-94F8-4700-B651-E79BB21ACBC2.XML 10341000x800000000000000073601Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:07.950{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073600Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:07.928{8057F119-21BD-60EC-4B07-00000000DB01}58806200C:\Windows\Explorer.EXE{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+61724|C:\Windows\System32\SHELL32.dll+62827|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7b7ef|C:\Windows\System32\windows.storage.dll+7a56f|C:\Windows\System32\windows.storage.dll+7d51f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073599Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:07.912{8057F119-21BD-60EC-4B07-00000000DB01}58805064C:\Windows\Explorer.EXE{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+61724|C:\Windows\System32\SHELL32.dll+62250|C:\Windows\System32\TwinUI.dll+12d491|C:\Windows\System32\TwinUI.dll+12df7f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073598Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:07.912{8057F119-21BD-60EC-4B07-00000000DB01}58805064C:\Windows\Explorer.EXE{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+12d2c9|C:\Windows\System32\TwinUI.dll+12df7f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000073597Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:07.411{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=26087D0C0D1586F498E8FBC2C772F7AA,SHA256=B49B09AD6EEFEEF0377C8E896583E66C819C81256D4411590AFA05A4203E07C6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032107Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:07.209{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E75B3A7698A69E3BDEC5240047A9BD62,SHA256=E2C716FB3C41C3B4ED1CCED9CB856CC14063909701CDCB75CBE7E420CEE1503B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073596Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:07.396{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073595Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:07.380{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073594Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:07.380{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073593Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:07.380{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073592Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:07.365{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073591Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:07.365{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073590Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:07.365{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073589Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:07.365{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2AAE-60EC-1109-00000000DB01}4020C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 10341000x800000000000000073613Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.567{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073612Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.567{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073611Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.529{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073610Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.514{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000073609Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.414{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4AD13013A5A4644E348C53B2D56E3500,SHA256=51899191D50640446855D45D8BC57CAC219A3D0391A8EBCD1875B5989377E34B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000032109Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:06.516{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51567-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000032108Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:08.225{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AA7010028677BE6AE948D2D5111DEF6A,SHA256=7F4C8F84D94D52EDAC1831CE9EFACE9E2D7A68997608DFAB10DD4940BBCE5106,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073608Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.328{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2AAE-60EC-1109-00000000DB01}4020C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073607Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.097{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000073606Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.097{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 10341000x800000000000000073605Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.065{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2BB4-60EC-4409-00000000DB01}7908C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa4f7|C:\Program Files\Mozilla Firefox\xul.dll+da83b9|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f|C:\Program Files\Mozilla Firefox\xul.dll+3f65e|C:\Program Files\Mozilla Firefox\xul.dll+3c0f18|C:\Program Files\Mozilla Firefox\xul.dll+3bfb5f|C:\Program Files\Mozilla Firefox\xul.dll+39d6aba|C:\Program Files\Mozilla Firefox\xul.dll+3a73bd7|C:\Program Files\Mozilla Firefox\xul.dll+3a75159|C:\Program Files\Mozilla Firefox\xul.dll+3f13|C:\Program Files\Mozilla Firefox\firefox.exe+1594|C:\Program Files\Mozilla Firefox\firefox.exe+4c518|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000032110Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:09.240{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CCE161F031B257353DC8204F60AF3BC0,SHA256=100DDD793204B4AC4FD03DFEAE60651100C13D61F7A60982DC26EE1B1F1C954F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073626Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.145{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63321-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local389ldap 354300x800000000000000073625Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.145{8057F119-08AE-60EC-2A00-00000000DB01}2932C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63321-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local389ldap 354300x800000000000000073624Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.131{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63320-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local389ldap 354300x800000000000000073623Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.130{8057F119-08AE-60EC-2A00-00000000DB01}2932C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63320-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local389ldap 10341000x800000000000000073622Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:09.466{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000073621Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:09.466{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 23542300x800000000000000073620Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:09.429{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EA411E0E9A5510DBED6CD562BBFC5DF9,SHA256=282325BCB3FBEB6260EBC8A207423EB82670943B60472F11EDB34CC5A4B43A1C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073619Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:09.382{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d8d317|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f 10341000x800000000000000073618Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:09.382{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 354300x800000000000000073617Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.104{8057F119-08A1-60EC-0D00-00000000DB01}896C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63319-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local135epmap 354300x800000000000000073616Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.104{8057F119-08AE-60EC-2A00-00000000DB01}2932C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63319-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local135epmap 23542300x800000000000000073615Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.998{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0229EEF5A7AB0466EC7F285DA4C6DE01,SHA256=AF9C5AE55E60F448412630DD2AF5887C38064CE31BCD2B00056A1DE8D5DD587F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073614Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:08.998{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2C6DC4EBEFA17B60FC3B45B38BADF059,SHA256=D572E62CCC45E75D49A1186F304EAEADCAC00FCA2BF405EA28E7F5BF51E6473E,IMPHASH=00000000000000000000000000000000falsetrue 22542200x800000000000000073631Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:09.559{8057F119-21D0-60EC-6307-00000000DB01}7172www.google.com02a00:1450:4001:808::2004;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073630Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:09.555{8057F119-21D0-60EC-6307-00000000DB01}7172www.google.com0172.217.16.132;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073629Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:09.554{8057F119-21D0-60EC-6307-00000000DB01}7172www.google.com0::ffff:172.217.16.132;C:\Program Files\Mozilla Firefox\firefox.exe 354300x800000000000000073628Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:09.265{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63322-false10.0.1.12-8000- 23542300x800000000000000073627Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:10.429{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8228E934449EC2B7E57C09F7712D8C36,SHA256=2EFD590C0D98A94C80D55793C5B01461B11D2E093F14BFA85CE26DB620BB158C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032111Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:10.256{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A171AAF54BB28E820BAEA5140AAD48C3,SHA256=C84BBD1EB3AEB6D608AECD895640C1813C5963F61AC2D357A129D361B35F80F8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073640Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:10.623{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local59043- 354300x800000000000000073639Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:10.623{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64660- 354300x800000000000000073638Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:10.623{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63133- 354300x800000000000000073637Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:10.622{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local54620- 354300x800000000000000073636Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:10.622{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local57085- 354300x800000000000000073635Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:10.621{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63689- 354300x800000000000000073634Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:09.685{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local55361- 354300x800000000000000073633Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:09.685{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobudptruefalse10.0.1.14win-dc-89.attackrange.local54617-false172.217.16.132zrh04s06-in-f132.1e100.net443https 23542300x800000000000000073632Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:11.442{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=89129FEEF3DE87E8FB2A53834C3EA805,SHA256=EC58DF0F1BF3D1C090ECB883C02C5D70AA5C7B1B1BF1E5766DFA11CB3E5B3C95,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032112Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:11.272{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CCCF29375A279AC83B54E8D043127D4C,SHA256=1C4FFE924A596E3039783200AE2D180B6DCB68252EFE17B87F4C48DC8B79FEC6,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073674Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.890{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073673Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.888{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073672Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.888{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073671Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.819{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073670Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.817{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073669Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.814{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073668Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.813{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073667Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.813{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073666Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.812{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073665Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.812{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073664Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.810{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073663Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.810{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073662Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.809{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073661Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.805{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073660Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.799{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073659Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.795{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073658Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.795{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073657Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.794{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073656Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.792{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073655Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.792{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073654Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.713{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d8d317|C:\Program Files\Mozilla Firefox\xul.dll+da05d3 10341000x800000000000000073653Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.713{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d 10341000x800000000000000073652Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.713{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d8d317|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f 10341000x800000000000000073651Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.712{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 10341000x800000000000000073650Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.709{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d8d317|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f 10341000x800000000000000073649Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.706{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 10341000x800000000000000073648Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.703{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6907-00000000DB01}8096C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+521b0|C:\Program Files\Mozilla Firefox\xul.dll+29fa9ed|C:\Program Files\Mozilla Firefox\xul.dll+29fa6b9|C:\Program Files\Mozilla Firefox\xul.dll+29f58ff|C:\Program Files\Mozilla Firefox\xul.dll+29c1801|C:\Program Files\Mozilla Firefox\xul.dll+4e6ea12|C:\Program Files\Mozilla Firefox\xul.dll+14a9071|C:\Program Files\Mozilla Firefox\xul.dll+14ab9bc|C:\Program Files\Mozilla Firefox\xul.dll+101613|C:\Program Files\Mozilla Firefox\xul.dll+3c2fad7|C:\Program Files\Mozilla Firefox\xul.dll+faae2|C:\Program Files\Mozilla Firefox\xul.dll+188d1c|UNKNOWN(00000059F97F7AC4) 10341000x800000000000000073647Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.665{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000073646Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.665{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 23542300x800000000000000073645Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.637{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\formhistory.sqlite-journalMD5=CA5C45A0E2EBB6D308487FE69B0FE74C,SHA256=0B7415EB6483473A36989CA5D9A80BB1535D219188A6B30345DFC95BCB4D5857,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073644Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.636{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05 10341000x800000000000000073643Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.636{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d 354300x800000000000000073642Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:10.626{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local62930- 23542300x800000000000000073641Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.454{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=87E1DE2A615EA2EE5244E9647E409DB8,SHA256=6EBC0BD379CDB5B767590D1583B732E2CB271C8C359A8A842DC4A8E54897E8C4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032113Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:12.272{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E20B63F08E6240FC4A5D54AE515F7A8E,SHA256=4FBACD2FE11C847AC6EF4507DE5882ABA40712D9AC93CB2EF273B201D79CE3A8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073685Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.941{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local57773- 354300x800000000000000073684Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.941{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobudptruefalse10.0.1.14win-dc-89.attackrange.local59198-false142.250.186.99fra24s06-in-f3.1e100.net443https 354300x800000000000000073683Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.937{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local59197- 354300x800000000000000073682Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.916{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local49498- 354300x800000000000000073681Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.886{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1-53domainfalse127.0.0.1-59114- 354300x800000000000000073680Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.862{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local59114- 23542300x800000000000000073679Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.842{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=416AD388A7BB32BA3DD721A202B1035B,SHA256=7BF2CEEDDDAA77F1FD62BBF24FB0ED4098506C24E8CE44EC61A8FE82B30E35AE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073678Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.540{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d8d317|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f 10341000x800000000000000073677Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.539{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 23542300x800000000000000032114Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:13.287{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B983DE47F775297E317CBBCFADD46491,SHA256=FA7742D6C7B5C46FAE3CFC2D6E34AD13FC06B15A65F11C417261D85972F1FCD1,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073676Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.320{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073675Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.254{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000073706Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.978{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local65319- 354300x800000000000000073705Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.978{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local49518- 354300x800000000000000073704Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.975{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local62988- 10341000x800000000000000073703Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.745{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05 10341000x800000000000000073702Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.745{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d 23542300x800000000000000073701Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.657{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\permissions.sqlite-journalMD5=A9EB072C09BE3E777F2C26C8D3000577,SHA256=03D20BA6DA3AE69393A4E7CA4B1451585FB4C3A58BEDEA94A7AE5A92FB36DDDE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073700Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.655{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000073699Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.655{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 354300x800000000000000073698Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.381{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63323-false142.250.184.227fra24s12-in-f3.1e100.net443https 354300x800000000000000073697Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.379{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobudptruefalse10.0.1.14win-dc-89.attackrange.local49253-false142.250.184.227fra24s12-in-f3.1e100.net443https 23542300x800000000000000073696Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.548{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=79F0EAE054BF5D8E7F898D20BCF38FAC,SHA256=739AF126D00EED5D002A827E24F565139D906A66452FF38E8E40B1FDA91E07AA,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000032116Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:12.547{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51568-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000032115Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:14.290{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8A990AFCCD73DC0FD1CA0AA6122816B0,SHA256=BF949B26071BB51442F90111B43BE33911F347377989A6347A3D0EC3BB221716,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073695Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.394{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000073694Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.394{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 354300x800000000000000073693Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.373{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local60691- 354300x800000000000000073692Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.371{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local49252- 354300x800000000000000073691Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.370{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63194- 10341000x800000000000000073690Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.299{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a 10341000x800000000000000073689Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.299{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002 22542200x800000000000000073688Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.813{8057F119-21D0-60EC-6307-00000000DB01}7172gstaticadssl.l.google.com02a00:1450:4001:80f::2003;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073687Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.811{8057F119-21D0-60EC-6307-00000000DB01}7172gstaticadssl.l.google.com0142.250.186.99;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073686Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:12.786{8057F119-21D0-60EC-6307-00000000DB01}7172pipeline-incoming-prod-elb-149169523.us-west-2.elb.amazonaws.com052.42.129.205;52.33.45.66;34.215.151.143;44.237.104.177;34.215.46.102;52.12.55.135;52.34.83.111;44.239.250.14;C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000073756Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.987{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d8d317|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f 10341000x800000000000000073755Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.987{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 23542300x800000000000000073754Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.893{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=594107A82425A63138BA8381E8887F55,SHA256=BBC57DCA2930586E9D1E78B76E22492FC778CC9254402881BC59349A4EFB09E8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073753Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.871{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local58101- 354300x800000000000000073752Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.871{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63324-false151.101.129.69-443https 354300x800000000000000073751Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.870{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local54711- 354300x800000000000000073750Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.866{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local49234- 10341000x800000000000000073749Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.786{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d8d317|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f 10341000x800000000000000073748Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.786{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 10341000x800000000000000073747Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.684{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000073746Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.541{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local54624- 354300x800000000000000073745Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.541{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local55370- 10341000x800000000000000073744Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.579{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000032117Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:15.306{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A5B0DEEDF162D7C6E377D12B309C92F7,SHA256=99ED5CE19172BCD798FA1455DDD30E9F09592DD30FB3BA07422E6ACFF5FE29BC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073743Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.212{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073742Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.211{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073741Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.210{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073740Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.209{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073739Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.208{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073738Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.204{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073737Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.194{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073736Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.194{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073735Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.178{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073734Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.171{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073733Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.167{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073732Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.161{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073731Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.161{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073730Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.143{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073729Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.135{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073728Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.134{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000073727Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.085{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobudptruefalse10.0.1.14win-dc-89.attackrange.local54620-false216.58.212.130ams15s21-in-f130.1e100.net443https 354300x800000000000000073726Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.083{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63237- 354300x800000000000000073725Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.080{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local62441- 354300x800000000000000073724Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.031{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local60037- 354300x800000000000000073723Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.030{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local60917- 354300x800000000000000073722Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.029{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobudptruefalse10.0.1.14win-dc-89.attackrange.local54622-false142.250.186.34fra24s04-in-f2.1e100.net443https 354300x800000000000000073721Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.029{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local62070- 354300x800000000000000073720Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.029{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local61650- 354300x800000000000000073719Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.026{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local61270- 23542300x800000000000000073718Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.074{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Local\Mozilla\Firefox\Profiles\ugslyq49.default-release\cache2\indexMD5=40F5CCD174A9CDB58F8B37CD8B15C03A,SHA256=780A017718242817B07671ACA4CAFEF6A88D7D92474873146C47818CA72038E7,IMPHASH=00000000000000000000000000000000falsetrue 22542200x800000000000000073717Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.739{8057F119-21D0-60EC-6307-00000000DB01}7172stackoverflow.com0::ffff:151.101.129.69;::ffff:151.101.65.69;::ffff:151.101.193.69;::ffff:151.101.1.69;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073716Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.952{8057F119-21D0-60EC-6307-00000000DB01}7172adservice.google.de0type: 5 pagead46.l.doubleclick.net;::ffff:142.250.74.194;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073715Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.904{8057F119-21D0-60EC-6307-00000000DB01}7172www3.l.google.com02a00:1450:4001:831::200e;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073714Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.900{8057F119-21D0-60EC-6307-00000000DB01}7172www3.l.google.com0172.217.16.142;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073713Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.900{8057F119-21D0-60EC-6307-00000000DB01}7172ogs.google.com0type: 5 www3.l.google.com;::ffff:172.217.16.142;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073712Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.850{8057F119-21D0-60EC-6307-00000000DB01}7172plus.l.google.com02a00:1450:4001:827::200e;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073711Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.848{8057F119-21D0-60EC-6307-00000000DB01}7172plus.l.google.com0142.250.185.238;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073710Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.847{8057F119-21D0-60EC-6307-00000000DB01}7172apis.google.com0type: 5 plus.l.google.com;::ffff:142.250.185.238;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073709Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.249{8057F119-21D0-60EC-6307-00000000DB01}7172id.google.com02607:f8b0:4006:81a::2003;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073708Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.245{8057F119-21D0-60EC-6307-00000000DB01}7172id.google.com0142.250.184.227;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073707Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:13.243{8057F119-21D0-60EC-6307-00000000DB01}7172id.google.com0::ffff:142.250.184.227;C:\Program Files\Mozilla Firefox\firefox.exe 734700x800000000000000073829Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.983{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dcomp.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft DirectComposition LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationdcomp.dllMD5=40873566DBFF13981CA1AE23AC281C5D,SHA256=E52C4619C837358454B969D31E2E14ACDEDABB384272D48C03E4F0AF9A2C2B6E,IMPHASH=9651C547656809410E78B358203C1A1DtrueMicrosoft WindowsValid 734700x800000000000000073828Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.969{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\libEGL.dll2.1.14225 git hash: 3778168311caANGLE libEGL Dynamic Link LibraryANGLE libEGL Dynamic Link Library-libEGL.dllMD5=BA4ABACD23368AEDAA4BBE5DEB09907C,SHA256=26EDA74DA83951DCD054C1AFFED2CE522C13FB4CF6800ABADB2D91F835C83134,IMPHASH=733FEA540C63883BB80910CFCF25367EtrueMozilla CorporationValid 734700x800000000000000073827Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.965{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\d3d9.dll10.0.14393.447 (rs1_release_inmarket.161102-0100)Direct3D 9 RuntimeMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D9.dllMD5=98326410B37312F3A57E8040250BDC32,SHA256=ADDEE549568ABA1E45C6868D76162F5DE6E58CBD83C43429EA0F9868ECA3DC42,IMPHASH=A3F81B60CD48F233C949F2E60B5C9AD4trueMicrosoft WindowsValid 734700x800000000000000073826Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.909{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\libGLESv2.dll2.1.14225 git hash: 3778168311caANGLE libGLESv2 Dynamic Link LibraryANGLE libGLESv2 Dynamic Link Library-libGLESv2.dllMD5=DA77F9E4005E78E0446A30409448D409,SHA256=D725D0A84F64D118C2E3346718D589292856C4E30D880868224D8667EF0AFA56,IMPHASH=EDF31D21C467DF72D61BCFE98451ECE4trueMozilla CorporationValid 23542300x800000000000000073825Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.925{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AB91991F029CD6D8253E9435448D8C2B,SHA256=1E9CC0FB1A1974AF79D4353CBF650F8733B7692D041F45A30B306B078D29BF39,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000073824Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.853{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\D3DCompiler_47.dll10.0.14393.3930 (rs1_release.200901-1914)Direct3D HLSL CompilerMicrosoft® Windows® Operating SystemMicrosoft Corporationd3dcompiler_47.dllMD5=6C441F5AD6724D68B27D9928C6C1170D,SHA256=EEA0AE3BDCEF59AF62F471E90C489044B8DB55BFF6377231E002A70AB1F8CF73,IMPHASH=6FDF9A87126D967D12E1FE5AAD5EEF07trueMicrosoft WindowsValid 23542300x800000000000000073823Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.914{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E217AF1B21B876AC71A37E07E90F9DA5,SHA256=92496CF0391F2290C0659594D3534A710F46E8CEB4A1717EB341A91D643111AE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073822Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.910{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobudptruefalse10.0.1.14win-dc-89.attackrange.local54624-false74.125.133.157wo-in-f157.1e100.net443https 354300x800000000000000073821Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.878{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63335-false74.125.133.157wo-in-f157.1e100.net443https 354300x800000000000000073820Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.851{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobudptruefalse10.0.1.14win-dc-89.attackrange.local57474-false142.250.186.161fra24s08-in-f1.1e100.net443https 354300x800000000000000073819Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.826{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local57473- 354300x800000000000000073818Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.826{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63334-false142.250.186.161fra24s08-in-f1.1e100.net443https 354300x800000000000000073817Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.812{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63429- 734700x800000000000000073816Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.726{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msdmo.dll10.0.14393.0 (rs1_release.160715-1616)DMO RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationmsdmo.dllMD5=3246C9C5ECF6555103C7119161ACC8C8,SHA256=3A29292F04B09A91C305062E00756194A83BDEA3ABB1BFB783D908E6D1BEBFBC,IMPHASH=B5AB2AA782AD334C5633AAE30A2CFF41trueMicrosoft WindowsValid 734700x800000000000000073815Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.724{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msacm32.dll10.0.14393.0 (rs1_release.160715-1616)Microsoft ACM Audio FilterMicrosoft® Windows® Operating SystemMicrosoft Corporationmsfltr32.acmMD5=CCA98E5C82E2636956A08C28DEAA739B,SHA256=6ECD122306AFF30FD1F8BB325C981A6177FA41CD8F4D7CA809E9B1ED6FF52F77,IMPHASH=02CCE03885FF4C014AF552A1F9D7F605trueMicrosoft WindowsValid 734700x800000000000000073814Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.695{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\Speech\Common\sapi.dll5.3.25307.00 (rs1_release.210107-1130)Speech APIMicrosoft® Windows® Operating SystemMicrosoft Corporationsapi.dllMD5=34432230D52A0BC141A809839D59102F,SHA256=A9645FE7B2860258846225636CDFBBB5D554260AD8A7598CFB0E62256566F1DC,IMPHASH=C38AE271B8F2290A059AC00D85D8CEA6trueMicrosoft WindowsValid 354300x800000000000000073813Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.567{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1-53domainfalse127.0.0.1-54316- 354300x800000000000000073812Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.543{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local54626- 354300x800000000000000073811Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.542{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local54625- 354300x800000000000000073810Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.542{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local49476- 354300x800000000000000073809Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.326{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobudptruefalse10.0.1.14win-dc-89.attackrange.local59803-false142.250.185.238fra16s53-in-f14.1e100.net443https 354300x800000000000000073808Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.233{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobudptruefalse10.0.1.14win-dc-89.attackrange.local59802-false172.217.23.98fra16s45-in-f2.1e100.net443https 354300x800000000000000073807Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.230{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63333-false10.0.1.12-8000- 354300x800000000000000073806Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.222{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63332-false142.250.185.195fra16s52-in-f3.1e100.net80http 23542300x800000000000000032118Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:16.321{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=57FFC179AF2680D257ED7B2CEEA8A56B,SHA256=D0D4F93056335470AAA9F630BD65DABBD48E135040E0482B24602740BA6545E6,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073805Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.406{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2F45-60EC-EE09-00000000DB01}10088C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+3c09f0|C:\Program Files\Mozilla Firefox\xul.dll+e16225|C:\Program Files\Mozilla Firefox\xul.dll+e164b6|C:\Program Files\Mozilla Firefox\xul.dll+e13e2e|C:\Program Files\Mozilla Firefox\xul.dll+e14060|C:\Program Files\Mozilla Firefox\xul.dll+28811fa|C:\Program Files\Mozilla Firefox\xul.dll+2880fb8|C:\Program Files\Mozilla Firefox\xul.dll+288463e|C:\Program Files\Mozilla Firefox\xul.dll+287e5a3|C:\Program Files\Mozilla Firefox\xul.dll+23116d|C:\Program Files\Mozilla Firefox\xul.dll+3e4c31|C:\Program Files\Mozilla Firefox\xul.dll+117d0d1|C:\Program Files\Mozilla Firefox\xul.dll+10ee581|C:\Program Files\Mozilla Firefox\xul.dll+3c47bd|C:\Program Files\Mozilla Firefox\xul.dll+11873b7|C:\Program Files\Mozilla Firefox\xul.dll+1112adc|C:\Program Files\Mozilla Firefox\xul.dll+1117990 10341000x800000000000000073804Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.406{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2BB4-60EC-4409-00000000DB01}7908C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+3c09f0|C:\Program Files\Mozilla Firefox\xul.dll+e16225|C:\Program Files\Mozilla Firefox\xul.dll+e164b6|C:\Program Files\Mozilla Firefox\xul.dll+e13e2e|C:\Program Files\Mozilla Firefox\xul.dll+e14060|C:\Program Files\Mozilla Firefox\xul.dll+28811fa|C:\Program Files\Mozilla Firefox\xul.dll+2880fb8|C:\Program Files\Mozilla Firefox\xul.dll+288463e|C:\Program Files\Mozilla Firefox\xul.dll+287e5a3|C:\Program Files\Mozilla Firefox\xul.dll+23116d|C:\Program Files\Mozilla Firefox\xul.dll+3e4c31|C:\Program Files\Mozilla Firefox\xul.dll+117d0d1|C:\Program Files\Mozilla Firefox\xul.dll+10ee581|C:\Program Files\Mozilla Firefox\xul.dll+3c47bd|C:\Program Files\Mozilla Firefox\xul.dll+11873b7|C:\Program Files\Mozilla Firefox\xul.dll+1112adc|C:\Program Files\Mozilla Firefox\xul.dll+1117990 10341000x800000000000000073803Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.406{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2B8F-60EC-3C09-00000000DB01}5920C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+3c09f0|C:\Program Files\Mozilla Firefox\xul.dll+e16225|C:\Program Files\Mozilla Firefox\xul.dll+e164b6|C:\Program Files\Mozilla Firefox\xul.dll+e13e2e|C:\Program Files\Mozilla Firefox\xul.dll+e14060|C:\Program Files\Mozilla Firefox\xul.dll+28811fa|C:\Program Files\Mozilla Firefox\xul.dll+2880fb8|C:\Program Files\Mozilla Firefox\xul.dll+288463e|C:\Program Files\Mozilla Firefox\xul.dll+287e5a3|C:\Program Files\Mozilla Firefox\xul.dll+23116d|C:\Program Files\Mozilla Firefox\xul.dll+3e4c31|C:\Program Files\Mozilla Firefox\xul.dll+117d0d1|C:\Program Files\Mozilla Firefox\xul.dll+10ee581|C:\Program Files\Mozilla Firefox\xul.dll+3c47bd|C:\Program Files\Mozilla Firefox\xul.dll+11873b7|C:\Program Files\Mozilla Firefox\xul.dll+1112adc|C:\Program Files\Mozilla Firefox\xul.dll+1117990 10341000x800000000000000073802Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.406{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-2AAE-60EC-1109-00000000DB01}4020C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+3c09f0|C:\Program Files\Mozilla Firefox\xul.dll+e16225|C:\Program Files\Mozilla Firefox\xul.dll+e164b6|C:\Program Files\Mozilla Firefox\xul.dll+e13e2e|C:\Program Files\Mozilla Firefox\xul.dll+e14060|C:\Program Files\Mozilla Firefox\xul.dll+28811fa|C:\Program Files\Mozilla Firefox\xul.dll+2880fb8|C:\Program Files\Mozilla Firefox\xul.dll+288463e|C:\Program Files\Mozilla Firefox\xul.dll+287e5a3|C:\Program Files\Mozilla Firefox\xul.dll+23116d|C:\Program Files\Mozilla Firefox\xul.dll+3e4c31|C:\Program Files\Mozilla Firefox\xul.dll+117d0d1|C:\Program Files\Mozilla Firefox\xul.dll+10ee581|C:\Program Files\Mozilla Firefox\xul.dll+3c47bd|C:\Program Files\Mozilla Firefox\xul.dll+11873b7|C:\Program Files\Mozilla Firefox\xul.dll+1112adc|C:\Program Files\Mozilla Firefox\xul.dll+1117990 10341000x800000000000000073801Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.406{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-226C-60EC-8A07-00000000DB01}5640C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+3c09f0|C:\Program Files\Mozilla Firefox\xul.dll+e16225|C:\Program Files\Mozilla Firefox\xul.dll+e164b6|C:\Program Files\Mozilla Firefox\xul.dll+e13e2e|C:\Program Files\Mozilla Firefox\xul.dll+e14060|C:\Program Files\Mozilla Firefox\xul.dll+28811fa|C:\Program Files\Mozilla Firefox\xul.dll+2880fb8|C:\Program Files\Mozilla Firefox\xul.dll+288463e|C:\Program Files\Mozilla Firefox\xul.dll+287e5a3|C:\Program Files\Mozilla Firefox\xul.dll+23116d|C:\Program Files\Mozilla Firefox\xul.dll+3e4c31|C:\Program Files\Mozilla Firefox\xul.dll+117d0d1|C:\Program Files\Mozilla Firefox\xul.dll+10ee581|C:\Program Files\Mozilla Firefox\xul.dll+3c47bd|C:\Program Files\Mozilla Firefox\xul.dll+11873b7|C:\Program Files\Mozilla Firefox\xul.dll+1112adc|C:\Program Files\Mozilla Firefox\xul.dll+1117990 10341000x800000000000000073800Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.406{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21E0-60EC-7207-00000000DB01}6340C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+3c09f0|C:\Program Files\Mozilla Firefox\xul.dll+e16225|C:\Program Files\Mozilla Firefox\xul.dll+e164b6|C:\Program Files\Mozilla Firefox\xul.dll+e13e2e|C:\Program Files\Mozilla Firefox\xul.dll+e14060|C:\Program Files\Mozilla Firefox\xul.dll+28811fa|C:\Program Files\Mozilla Firefox\xul.dll+2880fb8|C:\Program Files\Mozilla Firefox\xul.dll+288463e|C:\Program Files\Mozilla Firefox\xul.dll+287e5a3|C:\Program Files\Mozilla Firefox\xul.dll+23116d|C:\Program Files\Mozilla Firefox\xul.dll+3e4c31|C:\Program Files\Mozilla Firefox\xul.dll+117d0d1|C:\Program Files\Mozilla Firefox\xul.dll+10ee581|C:\Program Files\Mozilla Firefox\xul.dll+3c47bd|C:\Program Files\Mozilla Firefox\xul.dll+11873b7|C:\Program Files\Mozilla Firefox\xul.dll+1112adc|C:\Program Files\Mozilla Firefox\xul.dll+1117990 10341000x800000000000000073799Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.406{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D4-60EC-7007-00000000DB01}6928C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+3c09f0|C:\Program Files\Mozilla Firefox\xul.dll+e16225|C:\Program Files\Mozilla Firefox\xul.dll+e164b6|C:\Program Files\Mozilla Firefox\xul.dll+e13e2e|C:\Program Files\Mozilla Firefox\xul.dll+e14060|C:\Program Files\Mozilla Firefox\xul.dll+28811fa|C:\Program Files\Mozilla Firefox\xul.dll+2880fb8|C:\Program Files\Mozilla Firefox\xul.dll+288463e|C:\Program Files\Mozilla Firefox\xul.dll+287e5a3|C:\Program Files\Mozilla Firefox\xul.dll+23116d|C:\Program Files\Mozilla Firefox\xul.dll+3e4c31|C:\Program Files\Mozilla Firefox\xul.dll+117d0d1|C:\Program Files\Mozilla Firefox\xul.dll+10ee581|C:\Program Files\Mozilla Firefox\xul.dll+3c47bd|C:\Program Files\Mozilla Firefox\xul.dll+11873b7|C:\Program Files\Mozilla Firefox\xul.dll+1112adc|C:\Program Files\Mozilla Firefox\xul.dll+1117990 10341000x800000000000000073798Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.406{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6D07-00000000DB01}7292C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+3c09f0|C:\Program Files\Mozilla Firefox\xul.dll+e16225|C:\Program Files\Mozilla Firefox\xul.dll+e164b6|C:\Program Files\Mozilla Firefox\xul.dll+e13e2e|C:\Program Files\Mozilla Firefox\xul.dll+e14060|C:\Program Files\Mozilla Firefox\xul.dll+28811fa|C:\Program Files\Mozilla Firefox\xul.dll+2880fb8|C:\Program Files\Mozilla Firefox\xul.dll+288463e|C:\Program Files\Mozilla Firefox\xul.dll+287e5a3|C:\Program Files\Mozilla Firefox\xul.dll+23116d|C:\Program Files\Mozilla Firefox\xul.dll+3e4c31|C:\Program Files\Mozilla Firefox\xul.dll+117d0d1|C:\Program Files\Mozilla Firefox\xul.dll+10ee581|C:\Program Files\Mozilla Firefox\xul.dll+3c47bd|C:\Program Files\Mozilla Firefox\xul.dll+11873b7|C:\Program Files\Mozilla Firefox\xul.dll+1112adc|C:\Program Files\Mozilla Firefox\xul.dll+1117990 10341000x800000000000000073797Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.406{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6A07-00000000DB01}6676C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+3c09f0|C:\Program Files\Mozilla Firefox\xul.dll+e16225|C:\Program Files\Mozilla Firefox\xul.dll+e164b6|C:\Program Files\Mozilla Firefox\xul.dll+e13e2e|C:\Program Files\Mozilla Firefox\xul.dll+e14060|C:\Program Files\Mozilla Firefox\xul.dll+28811fa|C:\Program Files\Mozilla Firefox\xul.dll+2880fb8|C:\Program Files\Mozilla Firefox\xul.dll+288463e|C:\Program Files\Mozilla Firefox\xul.dll+287e5a3|C:\Program Files\Mozilla Firefox\xul.dll+23116d|C:\Program Files\Mozilla Firefox\xul.dll+3e4c31|C:\Program Files\Mozilla Firefox\xul.dll+117d0d1|C:\Program Files\Mozilla Firefox\xul.dll+10ee581|C:\Program Files\Mozilla Firefox\xul.dll+3c47bd|C:\Program Files\Mozilla Firefox\xul.dll+11873b7|C:\Program Files\Mozilla Firefox\xul.dll+1112adc|C:\Program Files\Mozilla Firefox\xul.dll+1117990 10341000x800000000000000073796Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.406{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6907-00000000DB01}8096C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+121488e|C:\Program Files\Mozilla Firefox\xul.dll+12e17ad|C:\Program Files\Mozilla Firefox\xul.dll+12b52aa|C:\Program Files\Mozilla Firefox\xul.dll+12b5164|C:\Program Files\Mozilla Firefox\xul.dll+3c09f0|C:\Program Files\Mozilla Firefox\xul.dll+e16225|C:\Program Files\Mozilla Firefox\xul.dll+e164b6|C:\Program Files\Mozilla Firefox\xul.dll+e13e2e|C:\Program Files\Mozilla Firefox\xul.dll+e14060|C:\Program Files\Mozilla Firefox\xul.dll+28811fa|C:\Program Files\Mozilla Firefox\xul.dll+2880fb8|C:\Program Files\Mozilla Firefox\xul.dll+288463e|C:\Program Files\Mozilla Firefox\xul.dll+287e5a3|C:\Program Files\Mozilla Firefox\xul.dll+23116d|C:\Program Files\Mozilla Firefox\xul.dll+3e4c31|C:\Program Files\Mozilla Firefox\xul.dll+117d0d1|C:\Program Files\Mozilla Firefox\xul.dll+10ee581|C:\Program Files\Mozilla Firefox\xul.dll+3c47bd|C:\Program Files\Mozilla Firefox\xul.dll+11873b7|C:\Program Files\Mozilla Firefox\xul.dll+1112adc|C:\Program Files\Mozilla Firefox\xul.dll+1117990 10341000x800000000000000073795Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.376{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000073794Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.376{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 354300x800000000000000073793Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.219{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local59801- 354300x800000000000000073792Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.218{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local65073- 354300x800000000000000073791Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.216{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64163- 354300x800000000000000073790Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.199{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63331-false172.217.23.98fra16s45-in-f2.1e100.net443https 354300x800000000000000073789Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.198{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63330-false142.250.185.238fra16s53-in-f14.1e100.net443https 354300x800000000000000073788Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.181{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local58770- 354300x800000000000000073787Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.181{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local55917- 354300x800000000000000073786Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.180{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64768- 354300x800000000000000073785Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.178{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64817- 354300x800000000000000073784Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.098{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63328-false192.0.73.2-443https 354300x800000000000000073783Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.098{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63329-false151.101.112.193-443https 354300x800000000000000073782Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.086{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local65037- 354300x800000000000000073781Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.085{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64555- 354300x800000000000000073780Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.085{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64622- 354300x800000000000000073779Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.083{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local60151- 354300x800000000000000073778Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.081{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63327-false151.101.65.69-443https 354300x800000000000000073777Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.077{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63326-false151.101.65.69-443https 354300x800000000000000073776Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.077{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local56739- 354300x800000000000000073775Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.076{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63325-false142.250.186.138fra24s07-in-f10.1e100.net443https 354300x800000000000000073774Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.072{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63540- 354300x800000000000000073773Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.071{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64420- 354300x800000000000000073772Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.069{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64711- 22542200x800000000000000073771Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.699{8057F119-21D0-60EC-6307-00000000DB01}7172pagead-googlehosted.l.google.com02a00:1450:4001:813::2001;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073770Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.696{8057F119-21D0-60EC-6307-00000000DB01}7172pagead-googlehosted.l.google.com0142.250.186.161;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073769Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.052{8057F119-21D0-60EC-6307-00000000DB01}7172www-google-analytics.l.google.com02a00:1450:4001:800::200e;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073768Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:15.051{8057F119-21D0-60EC-6307-00000000DB01}7172www-google-analytics.l.google.com0142.250.185.238;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073767Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.960{8057F119-21D0-60EC-6307-00000000DB01}7172www.gravatar.com02a04:fa87:fffe::c000:4902;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073766Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.958{8057F119-21D0-60EC-6307-00000000DB01}7172ipv4.imgur.map.fastly.net9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073765Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.956{8057F119-21D0-60EC-6307-00000000DB01}7172ipv4.imgur.map.fastly.net0151.101.112.193;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073764Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.955{8057F119-21D0-60EC-6307-00000000DB01}7172i.stack.imgur.com0type: 5 ipv4.imgur.map.fastly.net;::ffff:151.101.112.193;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073763Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.955{8057F119-21D0-60EC-6307-00000000DB01}7172www.gravatar.com0192.0.73.2;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073762Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.954{8057F119-21D0-60EC-6307-00000000DB01}7172www.gravatar.com0::ffff:192.0.73.2;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073761Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.950{8057F119-21D0-60EC-6307-00000000DB01}7172cdn.sstatic.net9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073760Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.947{8057F119-21D0-60EC-6307-00000000DB01}7172cdn.sstatic.net0151.101.1.69;151.101.129.69;151.101.193.69;151.101.65.69;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073759Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.943{8057F119-21D0-60EC-6307-00000000DB01}7172cdn.sstatic.net0::ffff:151.101.65.69;::ffff:151.101.1.69;::ffff:151.101.129.69;::ffff:151.101.193.69;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073758Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.752{8057F119-21D0-60EC-6307-00000000DB01}7172stackoverflow.com9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073757Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:14.741{8057F119-21D0-60EC-6307-00000000DB01}7172stackoverflow.com0151.101.65.69;151.101.193.69;151.101.1.69;151.101.129.69;C:\Program Files\Mozilla Firefox\firefox.exe 23542300x800000000000000073861Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:17.941{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=623F6905112369B5462097771D044A16,SHA256=3709DC36FFB06EE0B3C1900210625DC847B96E071F746CD58330C5F2180255FF,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073860Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.633{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobudptruefalse10.0.1.14win-dc-89.attackrange.local55545-false142.250.185.198fra16s52-in-f6.1e100.net443https 354300x800000000000000073859Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.555{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local55544- 354300x800000000000000073858Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.555{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local59056- 354300x800000000000000073857Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.550{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63270- 354300x800000000000000073856Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.545{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local57792- 354300x800000000000000073855Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.511{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63346-false172.217.16.132zrh04s06-in-f132.1e100.net443https 354300x800000000000000073854Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.507{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63345-false142.250.185.198fra16s52-in-f6.1e100.net443https 23542300x800000000000000032119Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:17.556{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC030104D02DD4C6D15F278D8694177A,SHA256=883CAA7B460F7C6654C05C52F55FA8ECF72C51DC0544BADD88D6D805B471B348,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073853Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:17.630{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Local\Mozilla\Firefox\Profiles\ugslyq49.default-release\cache2\doomed\4288MD5=54EBF9003423D5708AA56D8EAB88496F,SHA256=3CB0AAB3AD3A70EC916035CADA64C4DAE9B61745F4E248AC0C76EE8945828C45,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073852Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:17.626{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Local\Mozilla\Firefox\Profiles\ugslyq49.default-release\cache2\doomed\9349MD5=49F1B2C6574C763E763D7CDF2D748E27,SHA256=2E73B653C002F10501D577C00EB979505FC1CE478059A14CE60FE4AB1C40AB1F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073851Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.323{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63344-false142.250.186.99fra24s06-in-f3.1e100.net443https 354300x800000000000000073850Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.321{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63343-false142.250.186.99fra24s06-in-f3.1e100.net443https 354300x800000000000000073849Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.318{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobudptruefalse10.0.1.14win-dc-89.attackrange.local49311-false142.250.185.225fra16s53-in-f1.1e100.net443https 354300x800000000000000073848Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.274{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63342-false142.250.185.195fra16s52-in-f3.1e100.net80http 354300x800000000000000073847Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.257{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63341-false142.250.185.225fra16s53-in-f1.1e100.net443https 354300x800000000000000073846Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.210{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63340-false142.250.185.195fra16s52-in-f3.1e100.net80http 354300x800000000000000073845Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.191{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local49310- 354300x800000000000000073844Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.186{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63339-false142.250.185.225fra16s53-in-f1.1e100.net443https 354300x800000000000000073843Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.184{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63338-false142.250.185.225fra16s53-in-f1.1e100.net443https 354300x800000000000000073842Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.159{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local57881- 354300x800000000000000073841Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.143{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63337-false151.101.1.69-443https 354300x800000000000000073840Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.064{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63336-false172.217.23.98fra16s45-in-f2.1e100.net443https 354300x800000000000000073839Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.049{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local58490- 23542300x800000000000000073838Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:17.124{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\permissions.sqlite-journalMD5=3BFE2783A1786A4B051577ECE960CBAD,SHA256=D9BA1265200A735281FE47B69C41F0ADAFA32597EEDBA41DC1A8D39ADBA06459,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073837Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:17.064{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 22542200x800000000000000073836Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.063{8057F119-21D0-60EC-6307-00000000DB01}7172s0-2mdn-net.l.google.com02a00:1450:4001:80e::2006;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073835Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.061{8057F119-21D0-60EC-6307-00000000DB01}7172s0-2mdn-net.l.google.com0142.250.185.198;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073834Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.008{8057F119-21D0-60EC-6307-00000000DB01}7172clc.stackoverflow.com9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073833Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.005{8057F119-21D0-60EC-6307-00000000DB01}7172clc.stackoverflow.com0151.101.129.69;151.101.193.69;151.101.65.69;151.101.1.69;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073832Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.004{8057F119-21D0-60EC-6307-00000000DB01}7172clc.stackoverflow.com0::ffff:151.101.1.69;::ffff:151.101.129.69;::ffff:151.101.193.69;::ffff:151.101.65.69;C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000073831Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:17.023{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073830Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:16.987{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\CoreMessaging.dll10.0.14393.3930Microsoft CoreMessaging DllMicrosoft® Windows® Operating SystemMicrosoft CorporationCoreMessaging.dllMD5=3D9D2F367587B2E93F2868F52D4ACBDD,SHA256=B4B27A7D4B9B685B6015D090B6A3E0E578AFBDE8D6C06A8F2E606A439D5A4BA4,IMPHASH=92CA7117B99353AC45978E95EEB5A46DtrueMicrosoft WindowsValid 23542300x800000000000000073864Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:18.660{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0C0B686A19650EB149098C9237ECC599,SHA256=C3B5A8F1F9A27F072361F05151EE9E892287897B87415BBB99775B8FF3FB19CF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032120Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:18.681{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF80713388407B809D537764D0FBB59D,SHA256=849AC47ABA4F057ED77A46806BAD1F142C1582884B354EFD1203D02CDD587D6A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073863Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:18.328{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073862Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:18.299{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000032121Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:19.915{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=26D33E0DBA752C7A7FA58C800CA300F9,SHA256=9AA70AFE5C9854EE5970FDCDE43BF20D12C67C2E4F79AA59218F80A055C444C2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073868Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:19.669{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A00AE91FED95F6667905CC04B4AC5CFC,SHA256=36E35BC48FC8AA29EFFBE5C90D1AB9FC0D4068D72368FD66C3030DFD4B6EA5C4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073867Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:17.551{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64105- 10341000x800000000000000073866Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:19.168{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073865Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:19.128{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000073876Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:20.710{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AAD6803B0D26154596C2956252F9235D,SHA256=89F855760AE075C94A3BF6BB796530DCE3306EFDD97AF5085F44C2C46C83E463,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000032123Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:17.566{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51569-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 13241300x800000000000000032122Microsoft-Windows-Sysmon/Operationalwin-host-439-SetValue2021-07-12 12:03:20.759{50946567-0A81-60EC-1500-00000000DC01}1032C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d77715-0xe863d84c) 354300x800000000000000073875Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:19.308{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63348-false104.16.149.64-443https 354300x800000000000000073874Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:19.199{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local60921- 354300x800000000000000073873Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:19.199{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63347-false104.16.149.64-443https 354300x800000000000000073872Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:19.199{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63632- 10341000x800000000000000073871Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:20.024{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073870Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:20.022{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073869Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:20.020{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000073899Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.728{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1A1A707BA24AFEBA53FD505C7E1F4B12,SHA256=D26EAAD54878E27217C51823BC66BEFEC25293E7E0703CB679262DA575588593,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032124Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:21.150{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6F4146A25E170AAB386256A968F2827B,SHA256=A7C62332322631E50489F51DA17455BB4F028A2AC972FB9D6878FDA6C6B09385,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073898Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:20.154{8057F119-08A1-60EC-1000-00000000DB01}100C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.14win-dc-89.attackrange.local123ntpfalse169.254.169.123-123ntp 10341000x800000000000000073897Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.623{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073896Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.623{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073895Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.601{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073894Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.601{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073893Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.599{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073892Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.599{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073891Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.598{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073890Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.570{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073889Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.566{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073888Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.563{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073887Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.508{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073886Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.490{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073885Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.476{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073884Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.455{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073883Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.452{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073882Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.446{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073881Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.405{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073880Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.393{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 22542200x800000000000000073879Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:19.076{8057F119-21D0-60EC-6307-00000000DB01}7172cdn.cookielaw.org02606:4700::6810:9440;2606:4700::6810:9540;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073878Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:19.069{8057F119-21D0-60EC-6307-00000000DB01}7172cdn.cookielaw.org0104.16.148.64;104.16.149.64;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000073877Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:19.067{8057F119-21D0-60EC-6307-00000000DB01}7172cdn.cookielaw.org0::ffff:104.16.149.64;::ffff:104.16.148.64;C:\Program Files\Mozilla Firefox\firefox.exe 23542300x800000000000000073903Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:22.993{8057F119-08A1-60EC-1100-00000000DB01}108NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=9360CB86475306D7547616FB19E4F45C,SHA256=B04949C2BF17BF17F858071EAD82021B69FE647D4C22AEC218D10340B4CD43D8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073902Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:22.735{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3CCA803D04A985E361025FB9AFD3DABD,SHA256=91AF5763EFDC27AE580F1204C5B5DDC57C6063EF4DC4182E6B90FD514BC4DC15,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032125Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:22.386{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=68EA33786D053A5E71BF05B31F3294B7,SHA256=766D7FB0B6DA7411DB65EE1B7BFEC977837813D1F0EDEE0BEA72AEA99411A541,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073901Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:22.234{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073900Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:22.225{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073908Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:23.986{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073907Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:23.880{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073906Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:23.861{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000073905Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:23.739{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5E2F787BC81B5FED26AD83B50FB15AF8,SHA256=81345CF5759E896F72A2BD86EE810AAAFDB1F64025C71E3E76718AFC6251E9C5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000032140Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:23.573{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F8B-60EC-2805-00000000DC01}3936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032139Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:23.573{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032138Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:23.573{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032137Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:23.573{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032136Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:23.573{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032135Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:23.573{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032134Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:23.573{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032133Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:23.573{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032132Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:23.573{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032131Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:23.573{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032130Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:23.573{50946567-0A80-60EC-0500-00000000DC01}416432C:\Windows\system32\csrss.exe{50946567-2F8B-60EC-2805-00000000DC01}3936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000032129Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:23.573{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F8B-60EC-2805-00000000DC01}3936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000032128Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:23.574{50946567-2F8B-60EC-2805-00000000DC01}3936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000032127Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:23.417{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B54017E836E5B8CF33F99C394AEC8541,SHA256=225EE6020690F35C44E72F11AF11F207BFA08A8624EDCB6C538BC593A4070186,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073904Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:21.202{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63349-false10.0.1.12-8000- 23542300x800000000000000032126Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:23.386{50946567-0A81-60EC-1100-00000000DC01}972NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=259139CF8F1873074B69F66D3033D6BE,SHA256=75F74B6AA5F624EB61DB19905F9D58B420FDA474A6DFA343F0938E3391A6BDDA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073915Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:24.957{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d8d317|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede 10341000x800000000000000073914Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:24.957{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002 23542300x800000000000000073913Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:24.759{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B5E7761F84689EFDE0DEC5E0FFD2E8DA,SHA256=E236C0BF99110E25AD5FD98B2F4BEEAE57EB23C9B013DCCF64A1C9FC4A3C6DB7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000032171Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.870{50946567-2F8C-60EC-2A05-00000000DC01}15282472C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032170Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.620{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F8C-60EC-2A05-00000000DC01}1528C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032169Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.620{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032168Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.620{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032167Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.620{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032166Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.620{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032165Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.620{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032164Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.620{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032163Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.620{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032162Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.620{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032161Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.620{50946567-0A80-60EC-0500-00000000DC01}416432C:\Windows\system32\csrss.exe{50946567-2F8C-60EC-2A05-00000000DC01}1528C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000032160Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.620{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032159Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.620{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F8C-60EC-2A05-00000000DC01}1528C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000032158Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.621{50946567-2F8C-60EC-2A05-00000000DC01}1528C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000032157Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.604{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=69C508DA685BCE7FC6DA89CC78CAA622,SHA256=491FE0F1F99E5107C44016628CA290E65EF954044346329FBF1963822F55E697,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032156Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.604{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4733856B404B11CAF01F9E7BF36485BC,SHA256=F5A9653E266F9D3516F53B650BE33D58A40255D46D1F85416DECCED3A12E5DEC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032155Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.526{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8C8B8749C5CB37DEFD993308CAA16C0C,SHA256=A1B295C48926531F9EF1081E1875B7D5A055EA119219C0BE560D3B147DA1CBB4,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073912Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:24.388{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000073911Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:24.387{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 10341000x800000000000000073910Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:24.259{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a 10341000x800000000000000073909Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:24.259{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002 10341000x800000000000000032154Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.277{50946567-2F8C-60EC-2905-00000000DC01}32523592C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032153Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.073{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F8C-60EC-2905-00000000DC01}3252C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032152Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.073{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032151Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.073{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032150Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.073{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032149Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.073{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032148Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.073{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032147Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.073{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032146Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.073{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032145Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.073{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032144Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.073{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032143Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.073{50946567-0A80-60EC-0500-00000000DC01}416532C:\Windows\system32\csrss.exe{50946567-2F8C-60EC-2905-00000000DC01}3252C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000032142Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.073{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F8C-60EC-2905-00000000DC01}3252C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000032141Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:24.074{50946567-2F8C-60EC-2905-00000000DC01}3252C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000073922Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:25.773{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D60E20D7BE4D4937942742D08E96F18C,SHA256=8D38A25122516BF482155D0628A63592D4EDA500D96CA6A6E1590F562370E94B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000032200Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.761{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F8D-60EC-2C05-00000000DC01}944C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032199Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.761{50946567-0A80-60EC-0500-00000000DC01}4161044C:\Windows\system32\csrss.exe{50946567-2F8D-60EC-2C05-00000000DC01}944C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000032198Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.761{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032197Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.761{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032196Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.761{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032195Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.761{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032194Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.761{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032193Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.761{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032192Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.761{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032191Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.761{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032190Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.761{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032189Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.761{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F8D-60EC-2C05-00000000DC01}944C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000032188Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.763{50946567-2F8D-60EC-2C05-00000000DC01}944C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000032187Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.761{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BEDEC7DF1643CDFB2C6D0C7770C22ADF,SHA256=203E1AB5FE5CBF7BB01D6485ABA1EA2FDAEAF63B267C83D22BBBEF24A1EC8669,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032186Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.761{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=69C508DA685BCE7FC6DA89CC78CAA622,SHA256=491FE0F1F99E5107C44016628CA290E65EF954044346329FBF1963822F55E697,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073921Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:25.706{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073920Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:25.706{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073919Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:25.628{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073918Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:25.628{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073917Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:25.626{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000073916Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:25.021{8057F119-08AE-60EC-2D00-00000000DB01}3004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=A52F6585761A8E82F695C029A0DE8E39,SHA256=23013549159043F148E7F54E2980270BD42A6AB4C4FA368424ACDA42C74194F9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000032185Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.339{50946567-2F8D-60EC-2B05-00000000DC01}3452984C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032184Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.120{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F8D-60EC-2B05-00000000DC01}3452C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032183Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.120{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032182Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.120{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032181Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.120{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032180Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.120{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032179Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.120{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032178Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.120{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032177Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.120{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032176Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.120{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032175Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.120{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032174Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.120{50946567-0A80-60EC-0500-00000000DC01}416532C:\Windows\system32\csrss.exe{50946567-2F8D-60EC-2B05-00000000DC01}3452C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000032173Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.120{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F8D-60EC-2B05-00000000DC01}3452C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000032172Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:25.121{50946567-2F8D-60EC-2B05-00000000DC01}3452C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000073924Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:26.780{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=49E2F1F082705824BE455C70CFBE97A7,SHA256=32650DFB7E56554589024DEF347CFF3E7CD4854F1019F150080AFE79A44809BD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032203Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:26.776{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D6C3DB782B126A1B4A090C1541218DCF,SHA256=B962D38A1B3328C0301BA974CCE68029DA3AB36916FC27D203DE648C285F128A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032202Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:26.776{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=ED421E54A1D8EAB57ECBC435AB770320,SHA256=8142FB262581B33D986C6CDFFC4E25F78AF58A43F48ECE7847DBC28B65400495,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073923Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:25.143{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63350-false10.0.1.12-8089- 354300x800000000000000032201Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:23.581{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51570-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000032204Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:27.792{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=682F11DED2AABBB732CE132BAAEED5C1,SHA256=2A61720D0A2F5034BA315474B726F4B976261A1A371CD5380D2DF933E597E849,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073926Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:27.843{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000073925Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:27.802{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88424D1E6BCEBA2161214E2FEBF1FF43,SHA256=2550B7C308368F36FD6B34F65E16F8DD37DBA603D828AF249017C38233469ECA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073930Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:28.808{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8A33E8FD2F5632F6B116F6AD4D92033F,SHA256=A1B85267FA1B40617091B9C8CEAE2DD8845A14ED7A23CFFE9632E0B2E04CF528,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000032230Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.901{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F90-60EC-2E05-00000000DC01}796C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032229Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.901{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032228Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.901{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032227Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.901{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032226Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.901{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032225Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.901{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032224Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.901{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032223Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.901{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032222Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.901{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032221Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.901{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032220Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.901{50946567-0A80-60EC-0500-00000000DC01}416532C:\Windows\system32\csrss.exe{50946567-2F90-60EC-2E05-00000000DC01}796C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000032219Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.901{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F90-60EC-2E05-00000000DC01}796C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000032218Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.902{50946567-2F90-60EC-2E05-00000000DC01}796C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000032217Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.229{50946567-0AF3-60EC-A200-00000000DC01}25523008C:\Windows\system32\conhost.exe{50946567-2F90-60EC-2D05-00000000DC01}2004C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032216Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.229{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032215Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.229{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032214Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.229{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032213Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.229{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032212Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.229{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032211Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.229{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032210Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.229{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032209Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.229{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032208Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.229{50946567-0A80-60EC-0C00-00000000DC01}7283756C:\Windows\system32\svchost.exe{50946567-0A82-60EC-2200-00000000DC01}1376C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000032207Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.229{50946567-0A80-60EC-0500-00000000DC01}416532C:\Windows\system32\csrss.exe{50946567-2F90-60EC-2D05-00000000DC01}2004C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000032206Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.229{50946567-0AF3-60EC-9E00-00000000DC01}35563476C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{50946567-2F90-60EC-2D05-00000000DC01}2004C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000032205Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:28.230{50946567-2F90-60EC-2D05-00000000DC01}2004C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{50946567-0A80-60EC-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000073929Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:26.361{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63351-false10.0.1.12-8000- 10341000x800000000000000073928Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:28.132{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073927Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:28.011{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000073933Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-SetValue2021-07-12 12:03:29.919{8057F119-08A1-60EC-1000-00000000DB01}100C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d77715-0xedd9a248) 23542300x800000000000000073932Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:29.816{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=02BBE2EBD87B392F929B198F2E8B2A15,SHA256=3CE4167686AF5D995D1D86419880F43DF560DE5B5923B180B8A7E0FCB5B20EC7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032233Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:29.261{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5F75FCC4A4814EC5B76E7F286B779205,SHA256=AA5C662AB8B96EC3E491C9D91ABC134D2B42AA4E2380489A9915509FA9C349C0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032232Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:29.182{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6AE65008EB476576E818CC3EB455FE30,SHA256=DBBA4D6BA56234B11C43E2C5371D180684BEFA467761575D0D6FBAE58EA76110,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000032231Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:29.090{50946567-2F90-60EC-2E05-00000000DC01}7963960C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073931Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:29.681{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000073934Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:30.827{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=94ED64698D526B65EE6B1B1D340E246E,SHA256=9E4549D0EB3287DDB0368DBBEA2B4B8E2EC0A74E7134B65677292DB7F2826991,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032234Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:30.104{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D195E27371F44416B832CA13E14BA3C4,SHA256=23E9CFADF28F254C0802F32BFC52FCC24C0F9B6A02C246FD21C5D1D384C9EC54,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073935Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:31.845{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=651727D8FA2F1003BE6A130F492061D3,SHA256=D8D5B734BCEA1156A2A1DF1A19DD80FF26041624C29FD68FFFAB370C3B3CDB1B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000032236Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:29.409{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51571-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000032235Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:31.323{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3CAEE148D4218C2C0C0C6CDE5FEFA109,SHA256=6FC09338088C9AB4FC1F3E94DB1D90D1706FD76649F329573437293EE2633616,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073936Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:32.850{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=45CD89875D892DB46E463786ACD89954,SHA256=9E7E96F217B863042E244FFC98A0C2E5331FEEC5A4D898DD909BA3D4B42D8DF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032237Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:32.354{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C7AD1129FFB21054A1AF064281545E5,SHA256=923391DD3DEFE031D2B6EAD967E0A9D5E783DDC1644F00788D12AABDE80CA6F8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073939Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:33.859{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0FD683D4B71BF7C1062F2863DAC0D03C,SHA256=8942DA03B3E4608871EF3B83EEA604816B0C39CDE08C02855D532B511F9D8D9F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032238Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:33.419{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C3C0C3A3E095858F3C89A565A82D5D56,SHA256=5663CE608773637BC4F376C8D91B5EA996728AB5F2BCB1211CA728C9F8F4A6B9,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073938Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:32.152{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63352-false10.0.1.12-8000- 23542300x800000000000000073937Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:33.543{8057F119-29AA-60EC-DB08-00000000DB01}8952ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\ush62qqu.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmMD5=CD7E9CB79472575842E0F9A53C8C3386,SHA256=A39A23121E973119F2970AA6B8D81F3ACEA45746AF5E79555C168E2935FC1AF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073940Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:34.866{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B70D5AE833454094AC7ADD3B8BA7AB53,SHA256=DCA864233649D810729EE2FA5BFC5FB0861B474F3D04C8E6A5C76AFF49DF56BA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032239Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:34.435{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0B78E9B14862F16241C98B0A8BA44C66,SHA256=6A889DC8F0798C5492C0A7CF749594D294499D0B5F1ED1D535203CFA79865B92,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073947Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:35.959{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073946Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:35.949{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073945Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:35.912{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000073944Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:35.872{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=54532194CAE4CCD8FD64121A1BEDB621,SHA256=B60E19691F3EE82BB318C0113F9C4A845783C83004BD87B68441F8E46594605F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032240Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:35.513{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ADC22D0B563380A1BDA5FE9AE891F26E,SHA256=7072F968A238CC84624FF76E0766AB79C7EF7812ED1E8A60DA8AF0934D8D4CB9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073943Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:35.789{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073942Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:35.303{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073941Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:35.087{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000073948Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:36.890{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=85167AC3ECCC6B0B5E7A6BF963970E00,SHA256=D044EE1FE05CB86A926AD757230CA53C8E323FDE4AF1CFF892DF1F946F774ADD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032241Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:36.575{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9933A2E1FA363AFC4B5A8416F0E08096,SHA256=E341843E612F14CCCDA781EF3183F58597EC7427DE433A3C6B8CAE6C82BED84C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073949Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:37.900{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A8AF97B585D833FEEBE30F86F13BE4E8,SHA256=E9AD5B252CC567A34376DD3E418AFCB9031D11980166A7DDEB791755002FEC43,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032243Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:37.591{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D87D9A705C68B9C3C890BD8A04933378,SHA256=277D6DF07AF96FD6D448D8F7DBD1F51139C0A389995FAEBD803676FBB73D2589,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000032242Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:34.412{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51572-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000073951Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:38.909{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=38F8CB9230E6BD77DB417A948C72821D,SHA256=999B1D0D3051E67E9545CC4591A07B793CE67072A6CE2A3152425957BD621B23,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032244Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:38.622{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=92E57B1A8D56609A2558A779BB9B8E7B,SHA256=1B135BB0E9E1CFA1CE2E3BAB2FE61E67D8A9F09DA0B2046AB633C273407E6147,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073950Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:37.191{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63353-false10.0.1.12-8000- 23542300x800000000000000073954Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:39.914{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AADCC2DDA52AD0D81AAFFBC7B2972834,SHA256=6BCE3549C9048B63394A209DE0BD97BC4C1AD8947F895AFDAC35A0220A75C935,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032245Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:39.638{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=74A4FA4DA105696DB5AE067B5A0EB001,SHA256=81B61D5C98AE8489F738924BFEEF9D414E936AF9C0E1FA7DDA8B02BF34311BB8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073953Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:39.699{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073952Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:39.669{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000073959Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:40.922{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6C406124CC26E0A2E9CE54ADD1205930,SHA256=2CDA5CC0E6974C1E95230965F1E3E009D8499AB24C7CC6837375A365892352C7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032246Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:40.654{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CD6CD536E6800F33DB07F9FDD1A87CE2,SHA256=D7E8520CB181535C311F5F7EEBF9DBC9632275AD63BE9359845F3695E544B066,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073958Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:40.709{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073957Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:40.656{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073956Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:40.313{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073955Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:40.296{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000073961Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:41.930{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F54217437147E37329364F40A3225DFA,SHA256=52C335ECF3C92F2548C1E994A1E285044DD978A1E6D8A2645A0FCB4690544758,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032248Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:41.654{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F1F26F5470F6C0B9BFB5DCB4B32FC372,SHA256=C264071CF71A51C58CCC4F8D71AB916C8B90379043BAEAB9F2D2EE3ED9C19E0A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073960Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:41.538{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000032247Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:39.459{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51573-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000073962Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:42.932{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE0A32412E445849189C5F8F8A6FA18B,SHA256=21A7A486D5E675233DD5C34A7BC9522C33E0BA9248499FEFFCDD4B5356911587,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032249Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:42.669{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=454417825725808D95A4D3D9151E6CBD,SHA256=A31041F19EF8E4070E1773204A3F03AF78CCF6918A0E01C9661AC771106E3145,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073964Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:43.941{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=11EF1FCD9B153A72A1122EA47C531A5C,SHA256=12D8FA11EEFFED641E97737EF1C8C5F462902136F58600129BFD69E2F5C59D75,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032250Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:43.669{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1E1EFE2224BA99960A2E9C8763A7D642,SHA256=741835F54ECF53ECBCB8B67D272A59B644EF03A9C269737BE3246C1537BC85DE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000073963Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:42.358{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63354-false10.0.1.12-8000- 23542300x800000000000000073968Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:44.954{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E0F2D34F977116A94884601BD2957F8,SHA256=92F7390EEC672199607A79FA3AB450A5BFF9E72D90A19A68848CB6B93E2D1322,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032251Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:44.685{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CAAE5F893E4E39F9F5C2E01D572BEF33,SHA256=3869FD827B9E72B62C6EAD2EED3432247AD70A8C63462BBDAFE2D2795CC2E43B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073967Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:44.717{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073966Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:44.714{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073965Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:44.713{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000032252Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:45.685{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=16ED60456D58FCC5BC60FA5A8E5A55B8,SHA256=45199D4769C58FC095ED30F0682A960F836568DC8763EB52153E14104744E3A2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000073972Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:45.962{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=995F401C56E50FD08DBDE52AF4A56C1A,SHA256=14FC6D6818CADA12186957231FDACE51BF098429715472B9A7C2059AFE81B11E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000073971Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:45.233{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073970Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:45.232{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073969Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:45.148{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000032253Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:46.700{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3E583491126E005AE1C2E1F7782D81CD,SHA256=A359BE3B74A85653D9EECAF24343C4D49A714AE4668C3A0E4AF350A3394352F0,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000074078Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.900{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000074077Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.898{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000074076Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.897{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000074075Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.558{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000074074Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.556{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000074073Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.556{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000074072Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.554{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000074071Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.550{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000074070Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.549{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000074069Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.544{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000074068Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.543{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000074067Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.534{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000074066Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.532{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000074065Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.529{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000074064Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.529{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000074063Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.528{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000074062Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.526{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000074061Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.526{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000074060Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.526{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000074059Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.526{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000074058Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.526{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000074057Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.526{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000074056Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.525{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000074055Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.525{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000074054Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.525{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000074053Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.525{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000074052Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.525{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000074051Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.523{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000074050Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.523{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000074049Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.523{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000074048Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.523{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000074047Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.523{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000074046Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.523{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000074045Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.523{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000074044Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.523{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000074043Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.523{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000074042Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.523{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000074041Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.523{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000074040Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.523{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000074039Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.522{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000074038Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.522{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000074037Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.522{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000074036Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.521{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x800000000000000074035Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.519{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000074034Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.517{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000074033Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.517{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000074032Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.516{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000074031Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.515{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 10341000x800000000000000074030Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.515{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074029Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.515{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074028Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.514{8057F119-089E-60EC-0500-00000000DB01}412428C:\Windows\system32\csrss.exe{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000074027Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.514{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074026Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.514{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074025Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.514{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000074024Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.512{8057F119-2FA2-60EC-F709-00000000DB01}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000074023Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.294{8057F119-2FA1-60EC-F609-00000000DB01}75406792C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000074022Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.294{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000074021Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.292{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000074020Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.036{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000074019Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.035{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000074018Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.035{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000074017Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.034{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000074016Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.031{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000074015Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.031{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000074014Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.030{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000074013Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.030{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000074012Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.029{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000074011Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.018{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000074010Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.018{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000074009Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.018{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000074008Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.018{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000074007Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.014{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000074006Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.014{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000074005Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.014{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000074004Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.014{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000074003Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.014{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000074002Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.013{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000074001Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.013{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000074000Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.013{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000073999Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.013{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000073998Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.013{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000073997Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.013{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000073996Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.012{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000073995Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.012{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000073994Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.012{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000073993Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.011{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000073992Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.011{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000073991Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.011{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000073990Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.010{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000073989Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.010{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000073988Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.010{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000073987Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.009{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000073986Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.009{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000073985Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.009{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000073984Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.008{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000073983Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.006{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000073982Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.005{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000073981Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.004{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000073980Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:46.004{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000073979Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:45.998{8057F119-089E-60EC-0500-00000000DB01}412528C:\Windows\system32\csrss.exe{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000073978Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:45.998{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073977Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:45.998{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073976Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:45.998{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073975Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:45.998{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000073974Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:45.998{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000073973Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:45.994{8057F119-2FA1-60EC-F609-00000000DB01}7540C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000032254Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:47.716{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B9804B2D1BAD111120DE1AD006E1012B,SHA256=849A8D5C5F6CC78A25B686D5E801E02CB24C0E96F17EDD4848390E50A6959DB6,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000074133Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.341{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000074132Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.339{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000074131Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.338{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000074130Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.301{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D008537141699C8E45CA58B34CB24717,SHA256=16BA62A2BB7798398D6562E653B08C53424051F447C18E8E23910B31AAB56640,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000074129Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.070{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000074128Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.069{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000074127Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.068{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000074126Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.067{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000074125Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.064{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000074124Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.064{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000074123Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.062{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000074122Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.060{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000074121Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.048{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000074120Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.043{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000074119Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.043{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000074118Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.042{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000074117Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.042{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000074116Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.042{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000074115Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.040{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000074114Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.040{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000074113Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.040{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000074112Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.040{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000074111Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.038{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000074110Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.037{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000074109Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.037{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000074108Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.037{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000074107Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.036{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000074106Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.036{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000074105Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.035{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000074104Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.035{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000074103Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.035{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000074102Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.035{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000074101Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.035{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000074100Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.035{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000074099Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.035{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000074098Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.035{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000074097Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.035{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000074096Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.034{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000074095Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.034{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000074094Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.034{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 10341000x800000000000000074093Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.033{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000074092Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.030{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000074091Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.028{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000074090Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.027{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000074089Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.027{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074088Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.027{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000074087Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.026{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 10341000x800000000000000074086Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.025{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074085Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.025{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074084Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.025{8057F119-089E-60EC-0500-00000000DB01}412428C:\Windows\system32\csrss.exe{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000074083Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.024{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000074082Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.020{8057F119-2FA3-60EC-F809-00000000DB01}7352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000074081Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.023{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=88ACE0C1D670A3B760866C39EA913DEF,SHA256=547E1EBC0AD0B6536D03F51660B1DF8F10AA062D488B2BFB60ED4C5F532606AA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074080Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.023{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6905C91CD0C2EF803E8C5CDFDBD4C225,SHA256=AA2478281D1B88616DBAE048BFF422465A330A44BB37324846350228D4B152C2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074079Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:47.021{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0229EEF5A7AB0466EC7F285DA4C6DE01,SHA256=AF9C5AE55E60F448412630DD2AF5887C38064CE31BCD2B00056A1DE8D5DD587F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000032256Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:45.474{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51574-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000032255Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:48.732{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8A23870B655AB94D9F4A830A3DEB1597,SHA256=AAE040FE71CAC9FC9787C335F52BA5F42C276C61F965C7F60B6167F6DAF7E22E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074135Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:48.386{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3365DBBAF3DF7837C07AB1FA09ADA37C,SHA256=C54117C047F5963C3F250640E4680C71276607D77337CF8977B31772FDF640BE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074134Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:48.033{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=88ACE0C1D670A3B760866C39EA913DEF,SHA256=547E1EBC0AD0B6536D03F51660B1DF8F10AA062D488B2BFB60ED4C5F532606AA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032257Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:49.747{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D2EAF9B88AB2CC04FF1927A109B47552,SHA256=8B77F2BF347D3516BB43020B97F18C781FFDFE1D853698D954C3AB5EB8843BF1,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000074187Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.586{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000074186Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.586{8057F119-2FA5-60EC-F909-00000000DB01}87208360C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000074185Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.586{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000074184Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.586{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000074183Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.386{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000074182Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.386{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000074181Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.386{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000074180Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.386{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000074179Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.386{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000074178Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.386{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000074177Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.386{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000074176Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.386{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000074175Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000074174Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000074173Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000074172Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000074171Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000074170Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000074169Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000074168Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000074167Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000074166Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000074165Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000074164Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000074163Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000074162Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000074161Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000074160Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000074159Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000074158Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000074157Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000074156Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000074155Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000074154Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000074153Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000074152Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000074151Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000074150Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000074149Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000074148Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000074147Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000074146Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000074145Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000074144Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000074143Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074142Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074141Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074140Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074139Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-089E-60EC-0500-00000000DB01}412436C:\Windows\system32\csrss.exe{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000074138Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.370{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000074137Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.371{8057F119-2FA5-60EC-F909-00000000DB01}8720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000074136Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.033{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0936120819D998F76A23D023DC6CF559,SHA256=1EBB4BB47BC2422AFC824AFD6CD87810249FCC1048910C1861E44F919BEB35B3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032258Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:50.747{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D2FE7EF2F554E1AC0DEA57D49163C357,SHA256=78EFAF049CC6BE02E2E5288AB5AB50D5DC9FA9746E4197D256147A9CE96C1988,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000074298Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:48.385{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63355-false10.0.1.12-8000- 734700x800000000000000074297Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.771{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000074296Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.771{8057F119-2FA6-60EC-FB09-00000000DB01}37806968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000074295Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.771{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000074294Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.771{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000074293Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.601{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DB51DBC519F9DEA807C1D735EE9217A4,SHA256=D486DC1787A8B46C8267D4EDA205727BFC017CA16D073961547196D10FF3CB3D,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000074292Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.554{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000074291Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.554{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000074290Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.554{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000074289Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.554{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000074288Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.554{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000074287Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.554{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000074286Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.554{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000074285Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.554{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000074284Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.554{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000074283Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.554{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000074282Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.554{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000074281Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.554{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000074280Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.554{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000074279Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.552{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000074278Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.552{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000074277Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.552{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000074276Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.552{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000074275Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.552{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000074274Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.551{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000074273Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.551{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000074272Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.551{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000074271Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.551{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000074270Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.550{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000074269Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.550{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000074268Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.550{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000074267Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.549{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000074266Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.549{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000074265Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.549{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000074264Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.549{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000074263Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.549{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000074262Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.533{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000074261Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.533{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000074260Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.533{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000074259Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.533{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000074258Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.533{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000074257Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.533{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000074256Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.533{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000074255Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.533{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 10341000x800000000000000074254Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.533{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074253Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.533{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074252Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.533{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000074251Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.533{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000074250Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.533{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000074249Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.533{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000074248Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.533{8057F119-089E-60EC-0500-00000000DB01}412436C:\Windows\system32\csrss.exe{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000074247Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.533{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000074246Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.534{8057F119-2FA6-60EC-FB09-00000000DB01}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000074245Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.385{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A40E630280548FA0A190E416D5A68F1D,SHA256=0D3AFFB99448C95D63D67EBF643DAE59EF885EC1D3DCB3444FB287887802A19B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000074244Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.385{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074243Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.385{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074242Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.370{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074241Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.354{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000074240Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.270{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000074239Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.270{8057F119-2FA6-60EC-FA09-00000000DB01}10232660C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000074238Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.270{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000074237Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.254{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000074236Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.086{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B926B4DF4854E4A2233A7B2D2E6F767C,SHA256=37F6F4F778DD67AEB053C80A85A48BA8B7E807DFB448CA3655DC3BC975800B12,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000074235Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.054{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000074234Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.054{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000074233Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.054{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000074232Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.054{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000074231Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.053{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000074230Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.053{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000074229Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.052{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000074228Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.051{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000074227Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000074226Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000074225Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000074224Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000074223Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000074222Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000074221Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000074220Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000074219Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000074218Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000074217Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000074216Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000074215Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000074214Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000074213Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000074212Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000074211Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000074210Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000074209Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000074208Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000074207Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000074206Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000074205Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000074204Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000074203Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000074202Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000074201Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000074200Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000074199Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000074198Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000074197Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000074196Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000074195Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 10341000x800000000000000074194Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074193Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074192Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074191Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074190Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-089E-60EC-0500-00000000DB01}412436C:\Windows\system32\csrss.exe{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000074189Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.032{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000074188Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:50.033{8057F119-2FA6-60EC-FA09-00000000DB01}10232C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000032259Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:51.763{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=56A576CEEA655E6B16ED6F84901201FC,SHA256=C816E99A6B57F3895E0CA4D13F3E2FC93DF8BF2440821F1C4241A2B52012E835,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000074302Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.854{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63356-true0:0:0:0:0:0:0:1win-dc-89.attackrange.local389ldap 354300x800000000000000074301Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:49.854{8057F119-08AE-60EC-2800-00000000DB01}2912C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63356-true0:0:0:0:0:0:0:1win-dc-89.attackrange.local389ldap 23542300x800000000000000074300Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:51.554{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=463585C102A97DAE899197648F87EA09,SHA256=41893868AA9C9FC1FACFEE0ACF2426DD9A8072C766B8F21A8544F2A27B1D3486,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074299Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:51.056{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BA9B876C628110FD115AC19A0A085DEF,SHA256=0368036A0760616ED330861D9EE995F5FACCB22AD4789154A45F8921835F1E7B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032260Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:52.763{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B13F43EE9CD04D43B6DE5D9404B76418,SHA256=ED7DE4E61C30504301FB8ED6DE64972A113E638426D4C2905D7A850AE9B5D4C6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074303Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:52.071{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1747ABA4F4FB5446BDBDB33E4BACE6A6,SHA256=DC7DEB251CE8E3C3DA207C22A524B30C9D39AD47D859B59487C1098338B9944F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032261Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:53.769{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6852E4916241980F17B56990D0978840,SHA256=016EE6B022A54CE6B83296CE36920D9A0550219E2928B0F2B2BA8187B83617E8,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000074355Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.455{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000074354Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.453{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000074353Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.451{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000074352Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.203{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000074351Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.203{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000074350Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.203{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000074349Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.203{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000074348Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.203{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000074347Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.203{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000074346Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.203{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000074345Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.187{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=51F4F9025E6D236F5BF2C24C09E42C8E,SHA256=AE196933C3E292680C83B09F24CE9E6D498E34ECDD30ACB8C1544EEB4705F285,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000074344Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.187{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000074343Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.187{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000074342Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.187{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000074341Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.187{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000074340Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.187{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4046 (rs1_release.201028-1803)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E92A3F429653A81E4C53A0B474A817A5,SHA256=4ECAFDB8F0F20BFFC1A5516882FD59C961DEACC2B01F669ABF1D1895F6F90A55,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000074339Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.187{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=B54D1302F309C7E6E408C5B8566951C3,SHA256=491B17EE35BA993608C8A9EE6D6D2743496756F0FB2F2D43B7AF03F7C45EAA38,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000074338Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.187{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000074337Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.187{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000074336Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000074335Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000074334Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000074333Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000074332Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000074331Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000074330Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000074329Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000074328Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000074327Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000074326Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000074325Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000074324Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000074323Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000074322Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000074321Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000074320Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4350 (rs1_release.210407-2154)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=F9FE858A976B6D38FD5CEA46019B246A,SHA256=37F7417D0AA2A15121A14CF176F0C4A1B6BB01E290324CCA0DDB001F47E8C458,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000074319Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000074318Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000074317Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000074316Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-08B0-60EC-3800-00000000DB01}34403460C:\Windows\system32\conhost.exe{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000074315Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000074314Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000074313Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4350 (rs1_release.210407-2154)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=4C8F6DF16BD8E2739EC0D3439EA7507C,SHA256=79E203951A298D2818A9484A56521FA70DF19B7053F704378375128C7C48E8EE,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000074312Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 10341000x800000000000000074311Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074310Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074309Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074308Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-08A1-60EC-0C00-00000000DB01}840704C:\Windows\system32\svchost.exe{8057F119-08AE-60EC-2C00-00000000DB01}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074307Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-089E-60EC-0500-00000000DB01}412436C:\Windows\system32\csrss.exe{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000074306Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.171{8057F119-08AE-60EC-2D00-00000000DB01}30044024C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000074305Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.172{8057F119-2FA9-60EC-FC09-00000000DB01}10168C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8057F119-089F-60EC-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{8057F119-08AE-60EC-2D00-00000000DB01}3004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000074304Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.087{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A02E395991278A0FF397A2E73D3AC0D2,SHA256=A930BA89705FB0933775FFFD2DFC37FD081C5B2E4392053E2750FD8DF3366619,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032263Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:54.784{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2C003FEE06C2F35970A7414039B87CE3,SHA256=CFF1C996C804476F7CFE9D0D002D34D15A3552B681DA95B40AEE403617BB1A49,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000074358Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:53.386{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63357-false10.0.1.12-8000- 23542300x800000000000000074357Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:54.403{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=21B30643F55A0049847D2E80EDCB96C1,SHA256=352BE09B969E73FF487FC705B4D59CBBD80CF57A264D97BA9C47FA286E8D516F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074356Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:54.403{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=668A05975E22FBF5D538FCA74BEEF60A,SHA256=4A824E466C6E29CF1E2B0240C8A39CA3C975944C180264E6503FFF7ABD9DA4BF,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000032262Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:51.365{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51575-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000032264Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:55.800{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F4808497F2C2534C7F738A8DA12D29CB,SHA256=1DF897FB78F6C5EEEC84D6259E7537012EF953FC893C76DE0944BD0ED2CFEDC2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000074365Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:55.918{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074364Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:55.918{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074363Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:55.918{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074362Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:55.902{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074361Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:55.902{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074360Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:55.902{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000074359Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:55.418{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F3011DA30EE33EA1FE30E35CF2483B0A,SHA256=E2848BA0241F5C8E8ED403A71AE225F87A43CB9624A35E7639871027E8DF5A41,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032265Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:56.815{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8ACCB513192518DA4B5E07DF165080FF,SHA256=3263520A07B5395DF7653F62C28FA77AC198A294ADCC15BC22D16551CE44335C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074366Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:56.433{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=19ABE72522A396A139D4C2F01AE2A9A4,SHA256=2D382CA0AF5ED07D1F765C35AE4062107823639F83AE407271374D1BA58F750E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032266Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:57.831{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=85B31D45BC4D39406764AE9DCDE50C89,SHA256=C7A547F31FB9F104AD23AD2D6D9F4B9CAAE3A8A143772215FB0CBE8EF149E1AB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074367Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:57.451{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D7EF5F8787E23863487C1E9FD2CB27B1,SHA256=43B69C62FF5776132F2D02E43B1F760442BD413CEF74176A0BCBD2C6E24B37D6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032267Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:58.862{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E6C89B7BD329703730001600E0CB205C,SHA256=92B77CFD15EDB42CD3CF76A2B41BBF12416EF6B70503EBAFC2AD3BFFF85C0096,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000074373Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:58.672{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000074372Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:58.470{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F56B5B1594207691D4E496C0655755C3,SHA256=10429D50FC4F16BCA814128D8FF5A11892CFF021C639EF3B2293DB03468A6CF2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000074371Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:58.370{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074370Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:58.254{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074369Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:58.254{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074368Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:58.254{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000074401Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.815{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Local\Mozilla\Firefox\Profiles\ugslyq49.default-release\cache2\doomed\17145MD5=0DB30D04022DCD844073B36978687A80,SHA256=DED471E8C89A872CB88466E8D1B08F30742B07AEADBA8F13AC961AC6CE208B30,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000074400Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.655{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d8d317|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f 10341000x800000000000000074399Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.655{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 10341000x800000000000000074398Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.585{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d8d317|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f 10341000x800000000000000074397Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.585{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 10341000x800000000000000074396Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.510{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000074395Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.510{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 23542300x800000000000000074394Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.491{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7015E8DCE63DE2FE3F89207DBBC21504,SHA256=B663DA739CA9B0887ADB52270878C7ABB5F24BA426C282D0357BB62EC6EC2E98,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000074393Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.480{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a 10341000x800000000000000074392Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.480{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002 10341000x800000000000000074391Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.418{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a 10341000x800000000000000074390Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.417{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002 10341000x800000000000000074389Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.299{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074388Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.279{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074387Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.279{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074386Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.277{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074385Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.277{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074384Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.277{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074383Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.245{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074382Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.232{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074381Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.232{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074380Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.231{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074379Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.229{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074378Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.229{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074377Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.136{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000074376Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.136{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 10341000x800000000000000074375Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.069{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05 10341000x800000000000000074374Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.069{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d 23542300x800000000000000032269Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:00.034{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=83B7E89E82235F9AAF4E7C4FF41ADCF4,SHA256=ADAFDB40F422A1511317A2D95859D8645FC826B428199F34E9E209311DA316BC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000074421Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:00.980{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074420Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:00.980{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074419Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:00.957{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074418Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:00.955{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000074417Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:00.027{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local59506- 354300x800000000000000074416Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:00.000{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local54790- 354300x800000000000000074415Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.999{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local61330- 354300x800000000000000074414Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.925{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local62283- 354300x800000000000000074413Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.924{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local57455- 354300x800000000000000074412Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.923{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local60169- 354300x800000000000000074411Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.896{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63709- 354300x800000000000000074410Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.895{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local59730- 354300x800000000000000074409Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.873{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local58498- 354300x800000000000000074408Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.873{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobudptruefalse10.0.1.14win-dc-89.attackrange.local59624-false172.217.16.142zrh04s06-in-f142.1e100.net443https 354300x800000000000000074407Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.871{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local59623- 23542300x800000000000000074406Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:00.487{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=17FC277BCCD9B7F4C92E496E84CF3E07,SHA256=1E88CB3B6314ABCCD8EE0A67CECAFFD675284A32B36D3D6D32FFFED7A224169F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000074405Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.359{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63358-false10.0.1.12-8000- 23542300x800000000000000074404Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:00.255{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\permissions.sqlite-journalMD5=76D364C3467EEC82B34A7EACD9E81A51,SHA256=9E3E6E9E1395591B91697F6F78B8DD0E801986FB2B00F52B758715C81A61B948,IMPHASH=00000000000000000000000000000000falsetrue 22542200x800000000000000074403Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.744{8057F119-21D0-60EC-6307-00000000DB01}7172www3.l.google.com0142.250.185.206;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074402Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:03:59.743{8057F119-21D0-60EC-6307-00000000DB01}7172ogs.google.com0type: 5 www3.l.google.com;::ffff:142.250.185.206;C:\Program Files\Mozilla Firefox\firefox.exe 354300x800000000000000032268Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:03:56.558{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51576-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000032270Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:01.097{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4E201A1BFA55BF2085E5CB061690C531,SHA256=DAC71720F02E6520898375A971B6930F0A9002CB7AD9345093256B4662D2D742,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000074427Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:01.934{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a 10341000x800000000000000074426Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:01.934{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002 354300x800000000000000074425Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:00.164{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local55718- 354300x800000000000000074424Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:00.162{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local55761- 354300x800000000000000074423Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:00.112{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local55325- 23542300x800000000000000074422Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:01.497{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=02E950E8996A7583D96473D19166FCEC,SHA256=5F40700C3FEDAC315037BCC09B8E4B94679AFA47B51B5EEC11E31E95EC1B64CE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032271Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:02.275{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D2D213A5102AD92C2AF11985AC624664,SHA256=23A26AAD630DBF658B1C0F25D6CC77842137516EA1CCF5B19A55DA3C1573B060,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000074431Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:00.827{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local61758- 23542300x800000000000000074430Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:02.528{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AF87C9EEDEF61E780F7C64FA9245F50F,SHA256=EF01A29A9EA7C05570DA7C2356E57B1AB1336DD8CB491B6BAD10F17ABFBC9126,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000074429Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:02.030{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05|C:\Program Files\Mozilla Firefox\xul.dll+2d86a87|C:\Program Files\Mozilla Firefox\xul.dll+2d8654a|C:\Program Files\Mozilla Firefox\xul.dll+2d8720f 10341000x800000000000000074428Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:02.030{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 23542300x800000000000000032273Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:03.512{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD5C6F7B26A629CC8986CD3CBEE18043,SHA256=EC8BEA5B9E9B89D225397BC13475A3DF7B7F64BDBD084F0EE6FA60FFE5FDEB5D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000074443Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:03.993{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074442Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:03.993{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074441Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:03.993{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074440Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:03.993{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000074439Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-ConnectPipe2021-07-12 12:04:03.993{8057F119-21D0-60EC-6307-00000000DB01}7172\chrome.8096.5.151246434C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000074438Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:03.992{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 17141700x800000000000000074437Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-CreatePipe2021-07-12 12:04:03.992{8057F119-21D2-60EC-6907-00000000DB01}8096\chrome.8096.5.151246434C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000074436Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:03.838{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d87090|C:\Program Files\Mozilla Firefox\xul.dll+2d86f05 10341000x800000000000000074435Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:03.838{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d 10341000x800000000000000074434Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:03.620{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+169a00f|C:\Program Files\Mozilla Firefox\xul.dll+6828c0|C:\Program Files\Mozilla Firefox\xul.dll+17948c2|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571|C:\Program Files\Mozilla Firefox\xul.dll+2bbf9e4|C:\Program Files\Mozilla Firefox\xul.dll+6177f1|C:\Program Files\Mozilla Firefox\xul.dll+2d81e48|C:\Program Files\Mozilla Firefox\xul.dll+2d8d317|C:\Program Files\Mozilla Firefox\xul.dll+da05d3|C:\Program Files\Mozilla Firefox\xul.dll+40208|C:\Program Files\Mozilla Firefox\xul.dll+122aede|C:\Program Files\Mozilla Firefox\xul.dll+120351f 10341000x800000000000000074433Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:03.620{8057F119-21D0-60EC-6307-00000000DB01}71727176C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+3e7611|C:\Program Files\Mozilla Firefox\xul.dll+11fd9e1|C:\Program Files\Mozilla Firefox\xul.dll+122efe9|C:\Program Files\Mozilla Firefox\xul.dll+122ef09|C:\Program Files\Mozilla Firefox\xul.dll+122c730|C:\Program Files\Mozilla Firefox\xul.dll+122cc44|C:\Program Files\Mozilla Firefox\xul.dll+16b3e21|C:\Program Files\Mozilla Firefox\xul.dll+6817b9|C:\Program Files\Mozilla Firefox\xul.dll+6816c4|C:\Program Files\Mozilla Firefox\xul.dll+6814ad|C:\Program Files\Mozilla Firefox\xul.dll+6810b4|C:\Program Files\Mozilla Firefox\xul.dll+17948a3|C:\Program Files\Mozilla Firefox\xul.dll+17947f4|C:\Program Files\Mozilla Firefox\xul.dll+67fb0d|C:\Program Files\Mozilla Firefox\xul.dll+17910e7|C:\Program Files\Mozilla Firefox\xul.dll+179b388|C:\Program Files\Mozilla Firefox\xul.dll+178f3e6|C:\Program Files\Mozilla Firefox\xul.dll+178f8c3|C:\Program Files\Mozilla Firefox\xul.dll+2ffdc1d|C:\Program Files\Mozilla Firefox\xul.dll+64392d|C:\Program Files\Mozilla Firefox\xul.dll+63a002|C:\Program Files\Mozilla Firefox\xul.dll+2bc0571 23542300x800000000000000074432Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:03.533{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E1F16E039E57BF290FD21A66F104A78F,SHA256=DDDA9F89E0C202BC165B83E35489915161E31AF880B7E5126F57677768006EA6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032272Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:03.096{50946567-0AF3-60EC-9E00-00000000DC01}3556NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=A52F6585761A8E82F695C029A0DE8E39,SHA256=23013549159043F148E7F54E2980270BD42A6AB4C4FA368424ACDA42C74194F9,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000074491Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.025{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63359-false92.122.105.169a92-122-105-169.deploy.static.akamaitechnologies.com443https 354300x800000000000000074490Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.024{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local58928- 354300x800000000000000074489Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:03.851{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local61020- 354300x800000000000000074488Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:03.849{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64548- 10341000x800000000000000074487Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.760{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074486Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.750{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074485Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.748{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074484Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.740{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074483Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.739{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 22542200x800000000000000074482Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.087{8057F119-21D0-60EC-6307-00000000DB01}7172e10374.dscg.akamaiedge.net02a02:26f0:1700:483::2886;2a02:26f0:1700:492::2886;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074481Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.082{8057F119-21D0-60EC-6307-00000000DB01}7172e10374.dscg.akamaiedge.net023.203.79.223;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074480Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.057{8057F119-21D0-60EC-6307-00000000DB01}7172js.monitor.azure.com0type: 5 aijscdn2.azureedge.net;type: 5 aijscdn2.afd.azureedge.net;type: 5 firstparty-azurefd-prod.trafficmanager.net;type: 5 dual.part-0033.t-0009.t-msedge.net;type: 5 part-0033.t-0009.fb-t-msedge.net;13.107.253.61;13.107.226.61;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074479Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.057{8057F119-21D0-60EC-6307-00000000DB01}7172js.monitor.azure.com0type: 5 aijscdn2.azureedge.net;type: 5 aijscdn2.afd.azureedge.net;type: 5 firstparty-azurefd-prod.trafficmanager.net;type: 5 dual.part-0033.t-0009.t-msedge.net;type: 5 part-0033.t-0009.fb-t-msedge.net;::ffff:13.107.253.61;::ffff:13.107.226.61;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074478Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.044{8057F119-21D0-60EC-6307-00000000DB01}7172a1778.g2.akamai.net9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074477Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.042{8057F119-21D0-60EC-6307-00000000DB01}7172e13678.dscb.akamaiedge.net02a02:26f0:1700:487::356e;2a02:26f0:1700:493::356e;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074476Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.042{8057F119-21D0-60EC-6307-00000000DB01}7172a1778.g2.akamai.net02.18.213.27;2.18.213.74;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074475Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.041{8057F119-21D0-60EC-6307-00000000DB01}7172statics-marketingsites-wcus-ms-com.akamaized.net0type: 5 a1778.g2.akamai.net;::ffff:2.18.213.74;::ffff:2.18.213.27;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074474Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.040{8057F119-21D0-60EC-6307-00000000DB01}7172a1449.dscg2.akamai.net02a02:26f0:1700:3::5f65:1b8d;2a02:26f0:1700:3::5f65:1ba2;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074473Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.039{8057F119-21D0-60EC-6307-00000000DB01}7172e13678.dscb.akamaiedge.net023.3.109.244;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074472Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.038{8057F119-21D0-60EC-6307-00000000DB01}7172part-0033.t-0009.fb-t-msedge.net02620:1ec:48::61;2620:1ec:29::61;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074471Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.037{8057F119-21D0-60EC-6307-00000000DB01}7172a1449.dscg2.akamai.net02.18.213.74;2.18.213.56;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074470Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.036{8057F119-21D0-60EC-6307-00000000DB01}7172img-prod-cms-rt-microsoft-com.akamaized.net0type: 5 a1449.dscg2.akamai.net;::ffff:2.18.213.56;::ffff:2.18.213.74;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074469Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.036{8057F119-21D0-60EC-6307-00000000DB01}7172www-googletagmanager.l.google.com02a00:1450:4001:82b::2008;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074468Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.035{8057F119-21D0-60EC-6307-00000000DB01}7172part-0033.t-0009.fb-t-msedge.net013.107.226.61;13.107.253.61;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074467Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.032{8057F119-21D0-60EC-6307-00000000DB01}7172www-googletagmanager.l.google.com0172.217.23.104;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074466Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:03.897{8057F119-21D0-60EC-6307-00000000DB01}7172e12062.dscb.akamaiedge.net02a02:26f0:1700:49a::2f1e;2a02:26f0:1700:48b::2f1e;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074465Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:03.894{8057F119-21D0-60EC-6307-00000000DB01}7172e12062.dscb.akamaiedge.net092.122.105.169;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074464Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:03.721{8057F119-21D0-60EC-6307-00000000DB01}7172www.google.com0142.250.185.196;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074463Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:03.720{8057F119-21D0-60EC-6307-00000000DB01}7172www.google.com0::ffff:142.250.185.196;C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000074462Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.680{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074461Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.666{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074460Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.665{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074459Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.654{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074458Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.653{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000074457Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.556{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C069591EBE26329D4D7E9DB7C1E2DE09,SHA256=005231544A44A4CBFBADAC22281ECD9FBDC4980105CA0C82C9E90AB61FFD7C2D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032274Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:04.527{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C990E973123ACC4EDF76F80F722189F,SHA256=586078BF8DFE800DA30E0BA9B7ED6FE7EB2583FF77197B0281FD98D631F51672,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000074456Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.524{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074455Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.521{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074454Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.517{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074453Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.516{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074452Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.503{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074451Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.501{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074450Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.499{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074449Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.498{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000074448Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.403{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Local\Mozilla\Firefox\Profiles\ugslyq49.default-release\cache2\doomed\21381MD5=53B9B96564895EA2E73A3D3D76027242,SHA256=2EF0487B359F50CF60CB59901229F5D5A768A74B7D95B817E497E907BCF4A3DF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000074447Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.340{8057F119-08A1-60EC-1000-00000000DB01}1001724C:\Windows\system32\svchost.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074446Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.338{8057F119-08A1-60EC-1000-00000000DB01}1001724C:\Windows\system32\svchost.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000074445Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.178{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Local\Mozilla\Firefox\Profiles\ugslyq49.default-release\cache2\doomed\14053MD5=7E5FCEB539F396AE878D8C29B32960BF,SHA256=BCDAA62B0F877C3995B39525532D6796455416D94227DCBA0E95C92E2422CAAA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074444Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.038{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Local\Mozilla\Firefox\Profiles\ugslyq49.default-release\cache2\doomed\10838MD5=B4D89C4ECB2A59DCB023ED84CD966BF0,SHA256=E01D275519377751D3E2CE3280186313D3677BD9B42713E22196A80BECC6D95F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032277Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:05.762{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0523280409E80B21E12A04B4BD584DC8,SHA256=486A70BD43D497CDFA08B86B7AD8625FB68313182E8FB9E0F85DF7AD30355277,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000074568Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.983{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63372-false162.247.243.146-443https 354300x800000000000000074567Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.979{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local60530- 354300x800000000000000074566Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.882{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63371-false151.101.13.27-443https 354300x800000000000000074565Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.881{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local61652- 354300x800000000000000074564Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.841{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local61704- 354300x800000000000000074563Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.840{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64836- 354300x800000000000000074562Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.840{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local59275- 354300x800000000000000074561Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.840{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local61163- 354300x800000000000000074560Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.839{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local62583- 354300x800000000000000074559Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.839{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63528- 354300x800000000000000074558Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.543{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63370-false104.117.196.154a104-117-196-154.deploy.static.akamaitechnologies.com443https 354300x800000000000000074557Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.542{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local60884- 354300x800000000000000074556Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.542{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local57867- 10341000x800000000000000074555Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.834{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074554Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.826{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074553Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.764{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074552Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.759{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 22542200x800000000000000074551Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.961{8057F119-21D0-60EC-6307-00000000DB01}7172w.usabilla.com9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074550Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.958{8057F119-21D0-60EC-6307-00000000DB01}7172w.usabilla.com034.255.12.101;52.31.179.168;54.154.86.12;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074549Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.957{8057F119-21D0-60EC-6307-00000000DB01}7172w.usabilla.com0::ffff:54.154.86.12;::ffff:34.255.12.101;::ffff:52.31.179.168;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074548Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.854{8057F119-21D0-60EC-6307-00000000DB01}7172tls12.newrelic.com.cdn.cloudflare.net9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074547Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.853{8057F119-21D0-60EC-6307-00000000DB01}7172tls12.newrelic.com.cdn.cloudflare.net0162.247.243.147;162.247.243.146;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074546Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.852{8057F119-21D0-60EC-6307-00000000DB01}7172bam-cell.nr-data.net0type: 5 tls12.newrelic.com.cdn.cloudflare.net;::ffff:162.247.243.146;::ffff:162.247.243.147;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074545Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.752{8057F119-21D0-60EC-6307-00000000DB01}7172newrelic.map.fastly.net9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074544Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.751{8057F119-21D0-60EC-6307-00000000DB01}7172newrelic.map.fastly.net0151.101.13.27;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074543Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.750{8057F119-21D0-60EC-6307-00000000DB01}7172js-agent.newrelic.com0type: 5 newrelic.map.fastly.net;::ffff:151.101.13.27;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074542Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.416{8057F119-21D0-60EC-6307-00000000DB01}7172e13630.dscb.akamaiedge.net02a02:26f0:1700:48a::353e;2a02:26f0:1700:497::353e;C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000074541Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.703{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074540Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.702{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074539Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.701{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074538Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.682{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074537Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.678{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074536Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.671{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074535Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.636{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000074534Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.538{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local60413- 354300x800000000000000074533Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.369{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63369-false10.0.1.12-8000- 354300x800000000000000074532Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.330{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63367-false23.3.109.244a23-3-109-244.deploy.static.akamaitechnologies.com80http 354300x800000000000000074531Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.330{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63368-false23.203.79.223a23-203-79-223.deploy.static.akamaitechnologies.com80http 13241300x800000000000000074530Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-SetValue2021-07-12 12:04:05.375{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x800000000000000074529Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-SetValue2021-07-12 12:04:05.375{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x0098be7a) 13241300x800000000000000074528Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-SetValue2021-07-12 12:04:05.375{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7770d-0xa0f4a846) 13241300x800000000000000074527Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-SetValue2021-07-12 12:04:05.375{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d77716-0x02b91046) 13241300x800000000000000074526Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-SetValue2021-07-12 12:04:05.375{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7771e-0x647d7846) 13241300x800000000000000074525Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-SetValue2021-07-12 12:04:05.375{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x800000000000000074524Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-SetValue2021-07-12 12:04:05.375{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x0098be7a) 13241300x800000000000000074523Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-SetValue2021-07-12 12:04:05.375{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7770d-0xa0f4a846) 13241300x800000000000000074522Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-SetValue2021-07-12 12:04:05.375{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d77716-0x02b91046) 13241300x800000000000000074521Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-SetValue2021-07-12 12:04:05.375{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7771e-0x647d7846) 10341000x800000000000000074520Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.318{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074519Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.282{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074518Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.282{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000074517Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.216{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\ugslyq49.default-release\permissions.sqlite-journalMD5=ADE3F69984EC4259DB7C4761F325BF4E,SHA256=744DC10315A48782606DA5CE1A2BEA3C6CB498C3B0C5F8354DCA679CC11D4784,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000074516Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.196{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000074515Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.237{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobudptruefalse10.0.1.14win-dc-89.attackrange.local54624-false172.217.23.104mil04s23-in-f104.1e100.net443https 354300x800000000000000074514Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.216{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63366-false13.107.253.61-443https 354300x800000000000000074513Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.195{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1-53domainfalse127.0.0.1-56854- 354300x800000000000000074512Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.184{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1-53domainfalse127.0.0.1-59681- 354300x800000000000000074511Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.184{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63361-false13.107.253.61-443https 354300x800000000000000074510Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.176{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63365-false2.18.213.74a2-18-213-74.deploy.static.akamaitechnologies.com443https 354300x800000000000000074509Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.171{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local60975- 354300x800000000000000074508Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.171{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63363-false23.3.109.244a23-3-109-244.deploy.static.akamaitechnologies.com443https 354300x800000000000000074507Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.170{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63364-false23.3.109.244a23-3-109-244.deploy.static.akamaitechnologies.com443https 354300x800000000000000074506Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.170{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63362-false2.18.213.56a2-18-213-56.deploy.static.akamaitechnologies.com443https 354300x800000000000000074505Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.169{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64860- 354300x800000000000000074504Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.169{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local56854- 354300x800000000000000074503Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.168{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64117- 354300x800000000000000074502Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.167{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local57315- 354300x800000000000000074501Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.167{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local59102- 354300x800000000000000074500Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.167{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local65097- 354300x800000000000000074499Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.166{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local63436- 354300x800000000000000074498Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.163{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63360-false172.217.23.104mil04s23-in-f104.1e100.net443https 354300x800000000000000074497Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.163{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local55131- 354300x800000000000000074496Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.162{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64566- 354300x800000000000000074495Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.162{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local56633- 354300x800000000000000074494Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.160{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local59681- 354300x800000000000000074493Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:04.159{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local57868- 10341000x800000000000000074492Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.133{8057F119-089F-60EC-0B00-00000000DB01}6324048C:\Windows\system32\lsass.exe{8057F119-089C-60EC-0100-00000000DB01}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96ef2|C:\Windows\system32\kerberos.DLL+793e4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2d231|C:\Windows\system32\lsasrv.dll+2b3f4|C:\Windows\system32\lsasrv.dll+30949|C:\Windows\system32\lsasrv.dll+2e2a7|C:\Windows\system32\lsasrv.dll+2d231|C:\Windows\system32\lsasrv.dll+15e0d|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 354300x800000000000000032276Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:02.432{50946567-0AF3-60EC-9E00-00000000DC01}3556C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51578-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 354300x800000000000000032275Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:02.401{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51577-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000032278Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:06.902{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7573289430EE676BE3669F0C0B7F1B4A,SHA256=B1D3E1428779AFBDD199F6F14B7F03D17DB201022716F0CD259B749B014C7F56,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000074597Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.675{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63381-false52.114.132.22-443https 354300x800000000000000074596Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.361{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63380-false99.86.3.70server-99-86-3-70.fra6.r.cloudfront.net443https 354300x800000000000000074595Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.360{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local58117- 354300x800000000000000074594Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.348{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local64761- 354300x800000000000000074593Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.268{8057F119-089C-60EC-0100-00000000DB01}4SystemNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63379-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local445microsoft-ds 354300x800000000000000074592Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.268{8057F119-089C-60EC-0100-00000000DB01}4SystemNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63379-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local445microsoft-ds 354300x800000000000000074591Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.175{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-89.attackrange.local63378-false10.0.1.14win-dc-89.attackrange.local389ldap 354300x800000000000000074590Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.175{8057F119-08A1-60EC-1600-00000000DB01}1236C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63378-false10.0.1.14win-dc-89.attackrange.local389ldap 22542200x800000000000000074589Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.467{8057F119-21D0-60EC-6307-00000000DB01}7172skypedataprdcoleus02.cloudapp.net9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074588Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.457{8057F119-21D0-60EC-6307-00000000DB01}7172skypedataprdcoleus02.cloudapp.net052.114.132.22;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074587Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.240{8057F119-21D0-60EC-6307-00000000DB01}7172d6tizftlrpuof.cloudfront.net9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074586Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.230{8057F119-21D0-60EC-6307-00000000DB01}7172d6tizftlrpuof.cloudfront.net099.86.3.37;99.86.3.49;99.86.3.167;99.86.3.70;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000074585Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.229{8057F119-21D0-60EC-6307-00000000DB01}7172d6tizftlrpuof.cloudfront.net0::ffff:99.86.3.70;::ffff:99.86.3.37;::ffff:99.86.3.49;::ffff:99.86.3.167;C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000074584Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:06.398{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074583Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:06.174{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000074582Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.166{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63377-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local389ldap 354300x800000000000000074581Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.166{8057F119-08A1-60EC-1600-00000000DB01}1236C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63377-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local389ldap 354300x800000000000000074580Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.165{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63376-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local49666- 354300x800000000000000074579Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.165{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63376-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local49666- 354300x800000000000000074578Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.163{8057F119-08A1-60EC-0D00-00000000DB01}896C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63375-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local135epmap 354300x800000000000000074577Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.163{8057F119-089F-60EC-0B00-00000000DB01}632C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local63375-truefe80:0:0:0:9025:424a:f4fd:5b8win-dc-89.attackrange.local135epmap 354300x800000000000000074576Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.158{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63374-false143.204.214.169server-143-204-214-169.fra53.r.cloudfront.net80http 354300x800000000000000074575Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.157{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local61712- 354300x800000000000000074574Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.154{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local57110- 354300x800000000000000074573Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.114{8057F119-21D0-60EC-6307-00000000DB01}7172C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\bobtcptruefalse10.0.1.14win-dc-89.attackrange.local63373-false54.154.86.12ec2-54-154-86-12.eu-west-1.compute.amazonaws.com443https 354300x800000000000000074572Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.089{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local59300- 23542300x800000000000000074571Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:06.086{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=AEC10D528E773F27EFF2C4E6285800D7,SHA256=4E3DE63A5264B41A06A49AD332507F0B432DF505DB72CD5E7C6A5C475AB8FC66,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074570Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:06.086{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=84A2C13D9844CE4219124B13691930EB,SHA256=6F42553F8DE198A71C7FAEC9A1E2556E8A6859AF47E718285D6A6C863F18986E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074569Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:06.085{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B4A31F164A215DF0F5ECEB4E0CE529EF,SHA256=F8FD24506A07D71717B6F12E00D1D2DC250D43612AC2794A64EF3928FB387C78,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032279Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:07.949{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7756D98B1302A13187DF69A210450C5A,SHA256=0743A3982D9DC26819E54135957A1645726649BBED58832BF96A6D7FF014BCFE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000074602Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.844{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local62937- 354300x800000000000000074601Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:05.844{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local60068- 23542300x800000000000000074600Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:07.740{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=164E9423ADEA696051BB154C277C365B,SHA256=36B6FCBA5788073A7E4490E54B36F4BD8E708BFF8D42F41BB148706BD2C72963,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074599Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:07.336{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=AEC10D528E773F27EFF2C4E6285800D7,SHA256=4E3DE63A5264B41A06A49AD332507F0B432DF505DB72CD5E7C6A5C475AB8FC66,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074598Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:07.108{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=62F275FE319D4C9164B6C5B75E4EA3DB,SHA256=96A4BABA59D4A7CCEBA05414F96F66B1E22968487481FE768B271AC4B08B1F08,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032280Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:08.965{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5EC3D156C3B9D544057CAAAF3D7BEE66,SHA256=1EEB068DA9F1CEA97AC38114B01EC5FEC7CDF81FC1FB74D746EC5E605E0D8F2B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000074604Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:06.845{8057F119-08AE-60EC-2900-00000000DB01}2924C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-89.attackrange.local57466- 23542300x800000000000000074603Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:08.749{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=29F866DDB207BB231E89E3E44FA3B387,SHA256=8DDEF606EAAC8753EADE7BB0F561B4E72D1BAE0EF8CD8CCE17D8C44201884B6C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032282Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:09.980{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=33426C3E2664E7FAC8067277D6FBE82E,SHA256=02C45808914691862739A5B6CC1249FCD2877085F5C0BC2402168CCB399D5C2B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000074608Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:09.950{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000074607Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:09.931{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000074606Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:09.755{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=19B8411C32AA57A95913072CB7912ED4,SHA256=D6B5ECA7BE893D3F58A7D8BA70D346561505382EFD2BE6814D9BFB3E99BBD374,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000032281Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:07.535{50946567-0AFB-60EC-CC00-00000000DC01}1384C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-439.eu-central-1.compute.internal51579-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000074605Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:09.042{8057F119-21D0-60EC-6307-00000000DB01}7172ATTACKRANGE\bobC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\bob\AppData\Local\Mozilla\Firefox\Profiles\ugslyq49.default-release\cache2\doomed\12942MD5=8FEF8AA00E034CECB772901F336E9CE1,SHA256=211F46908E5E1C3B4801DEE955F6FF84A9527EFD66CD2FF7DD48FA5DB6097352,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074609Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:10.776{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0DCD772FB90114C7F0BE3B14AB287B9C,SHA256=9F75A7207B8AD05F2CD68F8B3023C10D02C6C175BAE2BD46EAAE5650A5664B5A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000074613Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:10.632{8057F119-089C-60EC-0100-00000000DB01}4SystemNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.255-138netbios-dgmfalse10.0.1.14win-dc-89.attackrange.local138netbios-dgm 354300x800000000000000074612Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:10.632{8057F119-089C-60EC-0100-00000000DB01}4SystemNT AUTHORITY\SYSTEMudptruefalse10.0.1.14win-dc-89.attackrange.local138netbios-dgmfalse10.0.1.255-138netbios-dgm 354300x800000000000000074611Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:10.369{8057F119-08BA-60EC-6D00-00000000DB01}2348C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-89.attackrange.local63382-false10.0.1.12-8000- 23542300x800000000000000074610Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:11.784{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F85A9905D35C76E75226C72B735E2044,SHA256=80EF53094B14DA9F5B1823DD005C1A5E14B94FE77E8A1394A0453E3BE4EE0141,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032283Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:10.996{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F2DF4B6BA771A163B9D354D5B42ED02A,SHA256=2CF309B4E3AB03D8D2B94E1C69357AED30E905AF67DF183B0718980A7467D5DF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074615Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:12.800{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CE338440154F34F95D2D57933729A8F5,SHA256=0E4ECCCD356D5C1CC846F69AB64584A9C3B1FC4026F89958FC6452DAB4F4134D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032284Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:12.011{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5F2082B26E9374D6A70758752544B4BC,SHA256=1F811A49600437F42A07BBED5111BC3F26111E04F8926F2EAE5BC49B5ACEBD81,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000074614Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:12.663{8057F119-21D0-60EC-6307-00000000DB01}71727656C:\Program Files\Mozilla Firefox\firefox.exe{8057F119-21D2-60EC-6807-00000000DB01}7892C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+2cf50|C:\Program Files\Mozilla Firefox\firefox.exe+2caa3|C:\Program Files\Mozilla Firefox\firefox.exe+40db0|C:\Program Files\Mozilla Firefox\firefox.exe+40aac|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000074616Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:13.806{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6C5A7CCD2BF3CA7F902F15BB2395FC54,SHA256=E81E438C5A49A70A0B002193B25DD3C2F8EBB4FFA02A7A4F40ED389718516D6C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032285Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:13.246{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=58B1881BC82F946889BA43E1559D9844,SHA256=A2DCF14F7CEA8FC38C3996AD9B59BA04DB6B1D7F3712A02D4368EB4182B9EF7E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074617Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:14.815{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=29BCA44630129037E8CB5D8F2415C8F2,SHA256=C986737DE29342A71C87DF793401EBADACBA227936191BD4982A06062B6F2C12,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032286Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:14.382{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2A5A0F212B31A237EA79D386FA89F34C,SHA256=60EAA8DBA09D54C2D196BC5D9A5A158F606998E418F2C461C8D4A06F62B960DB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074618Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:15.817{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB26C92EA00BA38DA185F8041959E19A,SHA256=50C0EA3335A605BCE104BA08746F61E648CDB02C73F012614B6D794003397D9F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000032287Microsoft-Windows-Sysmon/Operationalwin-host-439-2021-07-12 12:04:15.413{50946567-0B01-60EC-D900-00000000DC01}3852NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F483EF94704C929393B14C123F445520,SHA256=3DD121617604E7F097F090512D7A6F9047A74844FF36502445614E7184C38A55,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074628Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:16.860{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5599F32336098CC27522D9B52DF0DBD5,SHA256=FE63DBA9CB5D63144F5A9FCBF9A383065B3545765982BE4C6E54BAF699A46E8D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074627Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:16.859{8057F119-08C1-60EC-7600-00000000DB01}3076NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D8EEE4D8EEC4B06159E639F2287AF353,SHA256=51E650DA378384917F6E3687F2441E06FAAD320B7F9FAE6D8D2F65D438F63629,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000074626Microsoft-Windows-Sysmon/Operationalwin-dc-89.attackrange.local-2021-07-12 12:04:16.824{8057F119-08C1-60EC-7600-0000000