734700x800000000000000071482Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:17.182{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\d2d1.dll10.0.20348.3451 (WinBuild.160101.0800)Microsoft D2D LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationd2d1MD5=498B6D9E199A737C0DCB6E93CB4A0745,SHA256=1BDA3BA5DCAF1216FDA7C21F8F8B816F7EA61D60C1446578BE56C7EA0ED41559,IMPHASH=659C5A49EC73E2A24C0A3B093D48C0D8trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071481Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:17.198{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\DXCore.dll10.0.20348.3451 (WinBuild.160101.0800)DXCoreMicrosoft® Windows® Operating SystemMicrosoft CorporationDXCore.DLLMD5=AD9FC42A5BFA66645A90931D2094F6C0,SHA256=9A1C899D2F2E717164BD974D6117937ABF52F5D5E4E39BCF8BD5D92187E513DF,IMPHASH=2FB9E028C0FC769C949399B0F946850DtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071480Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:17.198{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\d3d10warp.dll10.0.20348.3451 (WinBuild.160101.0800)Direct3D RasterizerMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D10Warp.dllMD5=9640F54DB4FB2F42C5383E3EDF17BFDD,SHA256=62D0048D6056D7EC64D17662EE320726B5A399EF2EA3A36F5920ED2064DE8770,IMPHASH=E34BD9CB3C2533A3EB9C785EE196B879trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071479Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:17.182{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\d3d11.dll10.0.20348.3451 (WinBuild.160101.0800)Direct3D 11 RuntimeMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D11.dllMD5=F725825FF507B30996B1DCCE1032F060,SHA256=A0080D0391378D0057CA91271296931358E01B71E0B784957A1E84A4520E6F45,IMPHASH=62887D891E5FED207E873D55BAEF29D7trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071478Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:17.182{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\directxdatabasehelper.dll10.0.20348.3451 (WinBuild.160101.0800)DirectXDatabaseHelperMicrosoft® Windows® Operating SystemMicrosoft CorporationDirectXDatabaseHelper.DLLMD5=F60515EA6AC8E09CF191E39F3B0A981F,SHA256=8BDF7DCD7F001DF6F447BAEF870B49452AF2BAF3BEAA6E5CB3479912E71FB9BF,IMPHASH=DF7923B5D8D74BC0BF40581420ABF910trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071477Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:17.182{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\ResourcePolicyClient.dll10.0.20348.2849 (WinBuild.160101.0800)Resource Policy ClientMicrosoft® Windows® Operating SystemMicrosoft CorporationResourcePolicyClient.dllMD5=96CBBF531BB9FBB48C2F2DD65718C221,SHA256=AD059D84CC0C75B04F1CF5BC891F0AB01A8340441415B10EDB17A481B03ACFE5,IMPHASH=CAD2441DEF3E6F13BF380826E354BAA4trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071476Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:17.182{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\dxgi.dll10.0.20348.3692 (WinBuild.160101.0800)DirectX Graphics InfrastructureMicrosoft® Windows® Operating SystemMicrosoft Corporationdxgi.dllMD5=0384CFE913022A51072FCD4FE7A4F617,SHA256=B52DA13041F2B2F05E4F068220F68B1C10DF9980E360582FFCA2D82D305BAC9C,IMPHASH=ABF52300155480791BA8A146E5386CC1trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071475Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:17.182{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\msls31.dll3.10.349.0Microsoft Line Services library fileMicrosoft® Line ServicesMicrosoft CorporationMSLS31.DLLMD5=B58AC6CF98C6F4EB862539C85F62EBF3,SHA256=F92FC2019C3DF281A19304FC0F9761FCAE0CDB7EB89348B565C1D3BC357641E7,IMPHASH=AA09BD7F7B65F39BBDC0B13F5190B396trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071467Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:16.577{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll4.8.4161.0 built by: NET48REL1Microsoft .NET Runtime Managed Symbol WrappersMicrosoft® .NET FrameworkMicrosoft CorporationISymWrapper.dllMD5=869B7E56E8064D1D0F6FAF5CD2D0DFF1,SHA256=4489FF50C77DB3EF4267677F1CFA1401E2C2279B3ABEC10181144DD3D1C84776,IMPHASH=60BDEDB36C12CA056D42C58D8B814D29trueMicrosoft CorporationValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071466Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:16.577{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll4.8.4161.0 built by: NET48REL1Microsoft .NET Runtime Managed Symbol WrappersMicrosoft® .NET FrameworkMicrosoft CorporationISymWrapper.dllMD5=869B7E56E8064D1D0F6FAF5CD2D0DFF1,SHA256=4489FF50C77DB3EF4267677F1CFA1401E2C2279B3ABEC10181144DD3D1C84776,IMPHASH=60BDEDB36C12CA056D42C58D8B814D29trueMicrosoft CorporationValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071465Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:16.577{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll4.8.4161.0 built by: NET48REL1Microsoft .NET Runtime Managed Symbol WrappersMicrosoft® .NET FrameworkMicrosoft CorporationISymWrapper.dllMD5=869B7E56E8064D1D0F6FAF5CD2D0DFF1,SHA256=4489FF50C77DB3EF4267677F1CFA1401E2C2279B3ABEC10181144DD3D1C84776,IMPHASH=60BDEDB36C12CA056D42C58D8B814D29trueMicrosoft CorporationValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071464Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:16.135{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\gpapi.dll10.0.20348.4294 (WinBuild.160101.0800)Group Policy Client APIMicrosoft® Windows® Operating SystemMicrosoft Corporationgpapi.dllMD5=3A3540829E3FE49F0FD27C2100930BEC,SHA256=9EE51B729B3E29900D3792F9687F08E0FCF5926AD07D95730941DA20C7723D64,IMPHASH=4AC272831325FCE47E028FFDF0253D06trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071463Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:15.879{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationNative_v0400.dll4.8.4797.0 built by: NET48REL1LAST_BPresentationNative_v0400.dllMicrosoft® .NET FrameworkMicrosoft CorporationPresentationNative_v0400.dllMD5=A4DD3B52C7BF375F5DCC9139D67D8735,SHA256=04B39F3E5E7ABC4AA60E6A38576502E8D3200FB385DF70C4AF4FA8B116952CE4,IMPHASH=5CEA53BF8F182F0E10A6F255873A2DE6trueMicrosoft CorporationValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071462Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:15.829{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\msvcp140_clr0400.dll14.10.25028.0 built by: VCTOOLSD15RTMMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140_clr0400.dllMD5=8B44E02FE9B43C8535190C1FE253C05D,SHA256=852C3B1564C0E7412CF683BA8819494610B9DC0EBC117728FC0822BA1C3005EF,IMPHASH=402938935B68E97EE121A9C52E186F72trueMicrosoft CorporationValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071461Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:15.797{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\wpfgfx_v0400.dll4.8.4797.0 built by: NET48REL1LAST_Bwpfgfx_v0400.dllMicrosoft® .NET FrameworkMicrosoft Corporationwpfgfx_v0400.dllMD5=B25E8121D6180D34706E458631576630,SHA256=F47EEB160D21CD0D346792F4EA5FB4092298C65B024C8ADE6E04886202C3A722,IMPHASH=C63B91CC5A215FA3CFBEF035DE364BDCtrueMicrosoft CorporationValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071460Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:16.260{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\psapi.dll10.0.20348.2849 (WinBuild.160101.0800)Process Status HelperMicrosoft® Windows® Operating SystemMicrosoft CorporationPSAPIMD5=EA2F787D150612ACA9B679D8A7A9BAF7,SHA256=498C0E47FBDF4AAEA28B327974B9A481D6186CDE83C11B487D7CDA8C7482890E,IMPHASH=A19426362F5443C7159B76FBEAFD171FtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071459Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:15.733{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\DWrite.dll10.0.20348.3451 (WinBuild.160101.0800)Microsoft DirectX Typography ServicesMicrosoft® Windows® Operating SystemMicrosoft CorporationDWriteMD5=925102ACB81EB5DF0113358790F689B3,SHA256=0FE7940296CC9947AD20FAD9AB89501784794C4F6B67B6739352E79E7C59FAFB,IMPHASH=76DA650AB975DB5EC3801DE15476C922trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071458Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:15.733{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xaml\cfd22d8d4edb88bec5eb5d8a14344f95\System.Xaml.ni.dll4.8.4797.0 built by: NET48REL1LAST_BSystem.Xaml.dllMicrosoft® .NET FrameworkMicrosoft CorporationSystem.Xaml.dllMD5=D757651C57CD86FFC7084F19E245C8F6,SHA256=6FE75F26164A4BB16C99AE7C632CFD20BD3127A397292B80DEFE9D215E31800E,IMPHASH=00000000000000000000000000000000false-UnavailableEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071457Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:15.701{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\69e685aa1286b7e22f7afc2651ab57ed\PresentationFramework.ni.dll4.8.4797.0PresentationFramework.dllMicrosoft® .NET FrameworkMicrosoft CorporationPresentationFramework.dllMD5=29D25D00D84D39B0A046C64DF8A2F159,SHA256=8D01B68B0235EB78EA43B3D9857C0DE76294EE67C2047197BCCC9DC296E849D8,IMPHASH=00000000000000000000000000000000false-UnavailableEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071456Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:16.104{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\msasn1.dll10.0.20348.4648 (WinBuild.160101.0800)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=5EF6753DDA0238391FAB5D2631E5F155,SHA256=EC9F93A19B84A8D56DC638BA9319A70032B06E492E8F3A1CD2D16EB5958BE3CF,IMPHASH=F79599CA729D557E0381EC0A41471A27trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071455Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:16.104{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\crypt32.dll10.0.20348.4294 (WinBuild.160101.0800)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=0C9A17301E04A0F87CA14EEB28ACC878,SHA256=FDCFCA7858D18B5C0C4FD5A5EB6F23B5F47B16B6EF0028F95763E36F5596FFDA,IMPHASH=81443D72A7777FCE48106EA30BA4F1F5trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071454Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:16.086{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\wintrust.dll10.0.20348.4647 (WinBuild.160101.0800)Microsoft Trust Verification APIsMicrosoft® Windows® Operating SystemMicrosoft CorporationWINTRUST.DLLMD5=A38CBA0909CC091F75AD53F5EBCCAAC4,SHA256=042B8C4E8C5A1AE907B1ED7837188F47032B7AC035EB4E13BD6F523F0BB09A71,IMPHASH=823CC10017A452CA52C96E0F9CAE5065trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071453Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:16.086{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25110.6-0\MpClient.dll4.18.25110.6 (747f30181b4cd739116f0a6ad3cabef997251d7f)Client InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationmpclient.dllMD5=92EB9AED39BABCCA99A62F721038DB74,SHA256=34EA6243F33EE8FBFCCB07AA9A9E5620A430BCB9CA123D1D35C2BA7E805CAF22,IMPHASH=EDEEAF8E7B79861FDC037758586C4AEEtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071452Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:16.072{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll4.8.4795.0 built by: NET48REL1LAST_BMicrosoft .NET Runtime Just-In-Time CompilerMicrosoft® .NET FrameworkMicrosoft Corporationclrjit.dllMD5=E814B4EECC6AB7E81D966BA466220119,SHA256=7B45D761A0FA102E26630114CF5A452958B34057C9B26D0373F737B6C2F4A160,IMPHASH=9F2B44B648DE13A18C1ABC07250B85C2trueMicrosoft CorporationValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071451Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:16.038{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\3f3fd961ac4b50cc381408cb3dccf51f\System.Configuration.ni.dll4.8.4380.0 built by: NET48REL1LAST_BSystem.Configuration.dllMicrosoft® .NET FrameworkMicrosoft CorporationSystem.Configuration.dllMD5=60524966D87636B2F02A37C9684352ED,SHA256=E01E8DE742DC9BEAE23C2008EC426B2E4051DE2257A908929F14102E62146E3F,IMPHASH=00000000000000000000000000000000false-UnavailableEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071450Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:15.990{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\2141400a4f6af3a21d58d59207da3b1e\System.Xml.ni.dll4.8.4161.0 built by: NET48REL1.NET FrameworkMicrosoft® .NET FrameworkMicrosoft CorporationSystem.Xml.dllMD5=C034A44913776DB47A49A73B096853E9,SHA256=8D7D6FA2162D0C2D24FA888959086BD04429F17DDF4DCF62EE4BBDB5920233EC,IMPHASH=00000000000000000000000000000000false-UnavailableEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071449Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:15.269{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore\0e36b59aaf70f128f36c8769550272c1\PresentationCore.ni.dll4.8.4797.0 built by: NET48REL1LAST_BPresentationCore.dllMicrosoft® .NET FrameworkMicrosoft CorporationPresentationCore.dllMD5=07A7CE89274F4C841F67395CA2A35438,SHA256=CA45890A09B7BA69149FC8E31073E6977020B40C183C0BB25F90CF6B7FE8A45B,IMPHASH=00000000000000000000000000000000false-UnavailableEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071448Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:15.059{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\WindowsBase\0404395b4459dd3f804a508b08cc4cd4\WindowsBase.ni.dll4.8.4797.0 built by: NET48REL1LAST_BWindowsBase.dllMicrosoft® .NET FrameworkMicrosoft CorporationWindowsBase.dllMD5=46B45D66B20ECB2953FD07B32CFA0C4C,SHA256=039EF57BA0127F8DE5EA62EF2A283BA565841983D3BFD4517BD768482765A2C5,IMPHASH=00000000000000000000000000000000false-UnavailableEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071447Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:15.072{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\cryptbase.dll10.0.20348.4648 (WinBuild.160101.0800)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=4CD90DC8744437B4652FC81D6D2D2D78,SHA256=A0C3DBE6C4EEB2AF939806203C451396368D86A4264E494896841778859CF167,IMPHASH=A5E5FE83F5F03CF67F32FA1D74122B59trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071446Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:15.072{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\rsaenh.dll10.0.20348.3932 (WinBuild.160101.0800)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=553F98D12B18E4B212BB3FA0A6D4EF09,SHA256=C42E40E11D620B657BF3DBAEE07AF8CF3A93C7B3B85370275EEDCEA02C5484B0,IMPHASH=2B6F04EB1943A140AE1CCE6DA6838603trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071445Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:15.059{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\cryptsp.dll10.0.20348.4648 (WinBuild.160101.0800)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=040B6CE8143659BC4AC0920CE30EE52F,SHA256=DC118A77A92577C7722A833775639D9E2AC9ADD45DE9785FB2BB76C3607E787B,IMPHASH=258951B1A95B51F7466BC90A77F44D42trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071444Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:14.980{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\f14356f84a60885d684b1cf84d32d80b\System.Core.ni.dll4.8.4797.0 built by: NET48REL1LAST_B.NET FrameworkMicrosoft® .NET FrameworkMicrosoft CorporationSystem.Core.dllMD5=C5C6085ADF76231C4A29B60BE8267E46,SHA256=DE4DBDF0E3FAD099D62F3FE9CD4D6DF40F0F5AFB22D0EEC24B1BFDC196A59B5C,IMPHASH=00000000000000000000000000000000false-UnavailableEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071443Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:14.854{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\System\057f86919ea12b362e9919ffa2b7a235\System.ni.dll4.8.4798.0 built by: NET48REL1LAST_B.NET FrameworkMicrosoft® .NET FrameworkMicrosoft CorporationSystem.dllMD5=5F6362881F64D61ABEA073400E342FD8,SHA256=8C530B2EF6B6705E5DD2B23F23723D4B2CA348F1554A3E8E7DAF21A4821FDFA6,IMPHASH=00000000000000000000000000000000false-UnavailableEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071442Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:14.635{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll4.8.4795.0 built by: NET48REL1LAST_BMicrosoft Common Language Runtime Class LibraryMicrosoft® .NET FrameworkMicrosoft Corporationmscorlib.dllMD5=B18F5B48685A5185D3301F67671F7E3F,SHA256=2DAA4EB67887B0D20B3A3C49886E91DBF9E7F0B6F8A25C9536CD6A6EC4D5B388,IMPHASH=00000000000000000000000000000000trueMicrosoft CorporationValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071441Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:14.326{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\ucrtbase_clr0400.dll14.10.25028.0 built by: VCTOOLSD15RTMMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationucrtbase_clr0400.dllMD5=F8F171BE1820544E15B555847005355C,SHA256=CDDF9A2BF085AE59BA464B3BA6394AACFC342DA5F17D77FD5306054C8AABF153,IMPHASH=0524DC27AA10ADA72FFB6F88F5FD8829trueMicrosoft CorporationValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071440Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:14.310{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\vcruntime140_clr0400.dll14.10.25028.0 built by: VCTOOLSD15RTMMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140_clr0400.dllMD5=63936588122BDEE9624D02CE3F8F54EA,SHA256=21F7E6165CE8DD92DB8CDF48CEE83DE64B2B0807B7B499CF87678B70C6F8C32F,IMPHASH=CD244BF7A749BF0B13E038D2EE842BFCtrueMicrosoft CorporationValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071439Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:14.294{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll4.8.4795.0 built by: NET48REL1LAST_BMicrosoft .NET Runtime Common Language Runtime - WorkStationMicrosoft® .NET FrameworkMicrosoft Corporationclr.dllMD5=17A2B692603037C6E9C95EFE643F3FBC,SHA256=7C2AA62DE41045661A3B2A5DF548E51ACE7C639D8679B2C2456FDD09B5A81958,IMPHASH=C6A5C78EBCD3667C37FECB83C6E05B34trueMicrosoft CorporationValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071438Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:14.135{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll4.8.4380.0 built by: NET48REL1LAST_BMicrosoft .NET Runtime Execution EngineMicrosoft® .NET FrameworkMicrosoft Corporationmscoreei.dllMD5=3D399632BE44E90B6A6D71A4DF1048D0,SHA256=4DCFCE4FDCE10E39366D12067175614843EB348B277897B0B455560797826766,IMPHASH=005299FA213F652A596AC31760C5340BtrueMicrosoft CorporationValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071437Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:14.118{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\mscoree.dll10.0.20348.1 (WinBuild.160101.0800)Microsoft .NET Runtime Execution EngineMicrosoft® Windows® Operating SystemMicrosoft Corporationmscoree.dllMD5=7DDB05EC3BE80B951478E594294C0361,SHA256=9D8834AF8F090B5F3199176A289B9A219F0AE51D72B79DD23E4BA5BC0E3C9D2B,IMPHASH=A4E2FB81EB74C41F6CEEBA12158650EFtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071436Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.916{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\scrrun.dll10.0.20348.4294Microsoft ® Script RuntimeMicrosoft ® Script RuntimeMicrosoft Corporationscrrun.dllMD5=ABE358FEFD9ED4A9F515EDDCFCCA61A3,SHA256=4A41AC8AF2FCF0D2F118090219D4EA0B538B29FF36357D5F257E6F977FB6EE9F,IMPHASH=4AEAE9A602BC8A76B3803B4F909D84BFtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071435Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.911{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\wshom.ocx10.0.20348.4294Windows Script Host Runtime LibraryMicrosoft ® Windows Script Host Runtime LibraryMicrosoft Corporationwshom.ocxMD5=E890149E5CB7EA011DA7FA550A165949,SHA256=171848CF383128B8CF4F86BB78940372F92BFC4C83C7988B4552710B489FDCAD,IMPHASH=6BC5DB1EF80E893A013F8C8EEFF676AEtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071434Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.885{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25110.6-0\MpOAV.dll4.18.25110.6 (747f30181b4cd739116f0a6ad3cabef997251d7f)IOfficeAntiVirus ModuleMicrosoft® Windows® Operating SystemMicrosoft CorporationMpOAV.dllMD5=F47BA93C98142B576150B92E90D6440E,SHA256=2B4CADF0717907F1F42D78687E079F18D334E7595C93373E30FE376CC8AE0844,IMPHASH=876F81A277BF4C5C958E4D3BDB07CFEBtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071433Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.885{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\amsi.dll10.0.20348.2849 (WinBuild.160101.0800)Anti-Malware Scan InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationamsi.dllMD5=94960BCBA30B624A8044F153B6B6AD4C,SHA256=B0A2B3C075C7E705DC31E872F51FDFF00F571B8B806D025FE4867B340A7EF08C,IMPHASH=039A8C4DDEC776FDB61F493B45D37109trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071432Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.885{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\jscript.dll10.0.20348.4294Microsoft ® JScriptMicrosoft ® JScriptMicrosoft Corporationjscript.dllMD5=CCEE03E1EF3CDFBBB47F775A3067E14A,SHA256=7F89E837E5EA3422EBD52200B9AC1EA48BB9D5403445A8D9C19EE548429AAB11,IMPHASH=4F653F4D3DC5B2A370D1BD0477434074trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071431Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.816{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\msxml3.dll8.110.20348.3451MSXML 3.0Microsoft XML Core ServicesMicrosoft CorporationMSXML3.dllMD5=316F255264E65201A03353D7AA88AA02,SHA256=6988CB234C3ECA5EE250CF86B9A94B2960B51611CB8EA5EADF111852ADC792EC,IMPHASH=2E1D1E35C17BE5497D2DE33F06DC41B4trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071430Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.705{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\jscript9.dll11.00.20348.4050 (WinBuild.160101.0800)Microsoft ® JScriptInternet ExplorerMicrosoft Corporationjscript9.dllMD5=9A9A28484A6F5B70D4FEC9AEDA0B9781,SHA256=EDF2D16FDAE4F8A1E46D62F2CE42893DCB8A286B6C496973C0C3366D3EA1FDFA,IMPHASH=2859C6415FC9F0157214C4C7D9A0A4DCtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071429Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.641{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\msimtf.dll10.0.20348.1 (WinBuild.160101.0800)Active IMM Server DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMSIMTF.DLLMD5=431B32B5D4CD255689C74F723E250489,SHA256=5C9D67D99AE73007982F31AA5CC57661DB44D257A8CF3729777391A2F44180F7,IMPHASH=866D99D1B1563D3FD6392266BAAAED2FtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071428Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.545{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\wldp.dll10.0.20348.4647 (WinBuild.160101.0800)Windows Lockdown PolicyMicrosoft® Windows® Operating SystemMicrosoft Corporationwldp.dllMD5=A9BCBDE2BDD75D8C968F85E6B638A624,SHA256=5CF3EF8214630ABBA0A28F32D386926DCDB63F0CF82D5B02CF0BC66286BFF23F,IMPHASH=346D20A684F2BA93EF388F006787B95CtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071427Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.541{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\srpapi.dll10.0.20348.4647 (WinBuild.160101.0800)SRP APIs DllMicrosoft® Windows® Operating SystemMicrosoft Corporationsrpapi.dllMD5=7CA11D2028CC2F2A2CCC497C0EE7272B,SHA256=7FD681C08288AA8EA34E7C8B7587F6A645282D7489D4ABACD5E9946EE5EE761A,IMPHASH=387C1C27C0A9823941CBDF0098381AE6trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071426Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.752{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\AudioSes.dll10.0.20348.3451 (WinBuild.160101.0800)Audio SessionMicrosoft® Windows® Operating SystemMicrosoft CorporationAudioSes.DllMD5=E9B3424316777DB6CB91331D6E28831F,SHA256=103455A30880F67F53E8C9AC003E153A3EEF5D964BCBDC7F534F6134B3850397,IMPHASH=03C64B487103D2A98869189AECC01A08trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071425Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.307{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\umpdc.dll10.0.20348.1 (WinBuild.160101.0800)User Mode Power Dependency CoordinatorMicrosoft® Windows® Operating SystemMicrosoft Corporationumpdc.dllMD5=1295F4D6CB0D15CAD3DAC73DE95A1F9C,SHA256=A38CBBAA28317396EB32CF349DFD0A2EF5FA93592AB7593030B25EF598280FBE,IMPHASH=A53E27B84471C3023DE4013F41373EF6trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071424Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.291{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\DiagnosticDataSettings.dll10.0.20348.1 (WinBuild.160101.0800)Microsoft Windows Diagnostic Data SettingsMicrosoft® Windows® Operating SystemMicrosoft CorporationDiagnosticDataSettings.dllMD5=CDB4A9793DA7A925EB09BB0EB0667244,SHA256=F81B68DABBA6BC26B67E6E35D5DE86315B8723EB6B5F245643FE098E1DC48C5F,IMPHASH=B386EB61D26A98A25758BF7525E9BD83trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071423Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.729{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\winmm.dll10.0.20348.2849 (WinBuild.160101.0800)MCI API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMM.DLLMD5=AE0EF084BFA37140981773EA6020D16D,SHA256=C945EA3D731A1363058197EA2D3223F7DC1A96625E00AD8A0005168EB8B12C57,IMPHASH=50AA0C4F8D3600830691BCB4FCFA2C2CtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071422Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.291{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\mshtml.dll11.00.20348.4647 (WinBuild.160101.0800)Microsoft (R) HTML ViewerInternet ExplorerMicrosoft CorporationMSHTML.DLLMD5=8C5798DE3E3A748CBE8FA9B206316BDC,SHA256=4DF46E727DBA65460F9A8730EC80B47B2C0ACBFFFC78983264BA1CAFB4820FB0,IMPHASH=776BF276D4E4F7E3E33E9989A43C5B88trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071421Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.641{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\secur32.dll10.0.20348.2849 (WinBuild.160101.0800)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=C97AC198CE68D499ACE27051FD5704F2,SHA256=5C85E124D77F04F5B98E053E20B5A3F21AC574A6CA770EEFDE16771F5B4C2E0F,IMPHASH=69C5AF0E0688D65764368319476EB071trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071420Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.609{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\comdlg32.dll10.0.20348.3692 (WinBuild.160101.0800)Common Dialogs DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcomdlg32.dllMD5=02CA0350A3F88FD6910748F8A0E12847,SHA256=5555FB9E8111D57D2CB4665C6CC1600E7954DF668223AA4B838BC03AF1AC6AA4,IMPHASH=87BBBDAC344249FEFD087D8741F35AC5trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071419Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.577{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\TextInputFramework.dll10.0.20348.3451 (WinBuild.160101.0800)"TextInputFramework.DYNLINK"Microsoft® Windows® Operating SystemMicrosoft Corporation"TextInputFramework.DYNLINK"MD5=5B5316CBF2BB060FB26524D97EBD4D66,SHA256=8439A6B8050167E8AD4E88C9681AB94CD4A706FB7C24AF4699D512BCA7424303,IMPHASH=3808BC3C9254B1CDE04BDFE5F1AFB513trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071418Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.516{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\wininet.dll11.00.20348.3451 (WinBuild.160101.0800)Internet Extensions for Win32Internet ExplorerMicrosoft Corporationwininet.dllMD5=0C447205322D48207B1CBF8BFA971B99,SHA256=57014022F16CA0E96AE7E615E2FB06647FDD66D86D78E2E3CEF8FBE2E95A31F9,IMPHASH=CF56FE88D5707C49A854CF0FCEBAC0D8trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071417Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.291{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\powrprof.dll10.0.20348.1 (WinBuild.160101.0800)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=AE29869B55A629AD01B86C7F2FB2211B,SHA256=EB4DD0ED5200B26FA57CC814EFAD7422AE312947FA201EB6896FAD16E70584AD,IMPHASH=0EAA2D25E8CDD79256FD6A7E2979B042trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071416Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.055{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\msIso.dll11.00.20348.4297 (WinBuild.160101.0800)Isolation Library for Internet ExplorerInternet ExplorerMicrosoft CorporationmsIso.dllMD5=B5ACC64F0B30C9992FE98A557F484D50,SHA256=5ED0D59F7C04818E1342FFB7339E9E66F446435B400A7B83CCAC47EE7D83A32A,IMPHASH=3D92E92A488420A9EB3C00C9CCB05ADAtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071415Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.041{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\sxs.dll10.0.20348.2849 (WinBuild.160101.0800)Fusion 2.5Microsoft® Windows® Operating SystemMicrosoft CorporationSXS.DLLMD5=A4CCE9B39CC24E6B561E48D1D1AB1848,SHA256=1DB8E12B13F3EDFE8B99396BECCC94A0B7F0C45701DDFDB6EF22007D3ADF42D9,IMPHASH=FDAC5CFB74089664B1511BC5708EE184trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071414Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.041{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\winhttp.dll10.0.20348.3451 (WinBuild.160101.0800)Windows HTTP ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationwinhttp.dllMD5=6DBFB56345F9AC8422EE65A311BF248A,SHA256=E43F50D10381D1F8AC96BF37D41F23BB57F7CAC6A5F359C1629A53A93F4C54E3,IMPHASH=E24310A79FB964A7AFEF2A00907A7745trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071413Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.041{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\wkscli.dll10.0.20348.3207 (WinBuild.160101.0800)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3FB345D21B45429CEE5D7077ABEAD3EF,SHA256=035045F0920C6D5B6E257568B4FCF027E5B174356428781DA611B7479C3C2CF0,IMPHASH=3F729D8B487C6614270AEECC59F7D05EtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071412Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.041{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\netapi32.dll10.0.20348.2849 (WinBuild.160101.0800)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=4E917425ED1EC055D6842944A43610B5,SHA256=D30D837D4F4D3EF8C84D5986CDFAD2E30FB9DAFA8C0FFDC104060DBB0DEB5627,IMPHASH=0C1A11AABDF7D17704DA841A8F98F962trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071411Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:13.041{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\ieframe.dll11.00.20348.4294 (WinBuild.160101.0800)Internet BrowserInternet ExplorerMicrosoft CorporationIEFRAME.DLLMD5=5E48E081A7325690C3F0D4CB1F510579,SHA256=8633005C17407241A0164411808A1811AF2FE5432A4437A4BA69EF9114F43C67,IMPHASH=68D58123F6DEA2CA7A5F8A908DCB8D44trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071410Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.979{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\edputil.dll10.0.20348.2849 (WinBuild.160101.0800)EDP utilMicrosoft® Windows® Operating SystemMicrosoft CorporationEDPUTIL.DLLMD5=37907EAEAFC1D9EF954A6AE175F86D51,SHA256=5F09D97A54110F6F4FA6EDBE56D496F5CAEE93CB1ACE95ADFAFEC28638DCA453,IMPHASH=375DFF11C428AC148E92B9D3A2D0E648trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071409Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.927{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\coml2.dll10.0.20348.2849 (WinBuild.160101.0800)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOML2.DLLMD5=95F66437259D085E97DA8B4F263BF253,SHA256=D959A16E2100A894FCC4DD1425FFC28FA7C0ADE74447B42B18C4FD41E247EABD,IMPHASH=4D005DEC1ACD7D4B9CFC01A5AEBC53EEtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071408Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.655{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\version.dll10.0.20348.2849 (WinBuild.160101.0800)Version Checking and File Installation LibrariesMicrosoft® Windows® Operating SystemMicrosoft CorporationVERSION.DLLMD5=35971E8A71498911FE86DD70A888695B,SHA256=554DE4C9C64CBA19BB3437EDE1D3688F3D020285A182161658779B8B34614306,IMPHASH=34340C2C4E9AA6EF6AD12BB695FC695BtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071407Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.591{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\fltLib.dll10.0.20348.1 (WinBuild.160101.0800)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=D649F39339FEA392AB3170AC72E818DC,SHA256=659E469F8DADCB6C32AB1641817EE57C327003DFFA443C319D6594E5A212A068,IMPHASH=A2E518FE01113DC26ECD0B434E4FD20DtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071406Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.591{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\virtdisk.dll10.0.20348.2849 (WinBuild.160101.0800)Virtual Disk API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationVIRTDISK.DLLMD5=88D8EA3F515804CC45DCF8A076E0B7B8,SHA256=46144298225ED9C2B8F860809387F68497F1914DEE30852B0EAB28A55274C8F3,IMPHASH=3DB3092182FBCA27994F3B6E175373E2trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071405Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.575{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\atlthunk.dll10.0.20348.1 (WinBuild.160101.0800)atlthunk.dllMicrosoft® Windows® Operating SystemMicrosoft Corporationatlthunk.dllMD5=65D66360813C74B80FFF236A60250CB0,SHA256=0B26918ECA6A74FF1F56C250D41618B53D3FDD3CA23EF5C266D3C88478088E93,IMPHASH=0C6D81F57245ACA5D959363A751AF7F2trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071404Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.575{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\xmllite.dll10.0.20348.2849 (WinBuild.160101.0800)Microsoft XmlLite LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationXmlLite.dllMD5=243A198F0CAC6133310699AA03811963,SHA256=7D1C88EC99C045924371AE9115EFDB00CDEA64830274452B8CD82B486C2DEF64,IMPHASH=E26F9FF5FE808C3CFB82284A709CB37FtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071403Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.559{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\twinapi.appcore.dll10.0.20348.3692 (WinBuild.160101.0800)twinapi.appcoreMicrosoft® Windows® Operating SystemMicrosoft Corporationtwinapi.appcore.dllMD5=AB14F6257DB36DFCBA13B3F5D205FFD4,SHA256=283A635E84565DFE94BBDAB04F62674F2100C85F54A617C1700AECDE00A2CF90,IMPHASH=A6B6189ABC90113819B0CE53F945DD60trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071402Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.527{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\DataExchange.dll10.0.20348.4647 (WinBuild.160101.0800)Data exchangeMicrosoft® Windows® Operating SystemMicrosoft CorporationDataExchange.dllMD5=D386021B1E39B5F73B5280A20D2CD370,SHA256=1E4A9E18F9BABA14BEC1330F761DA956CB52A748EE787014C4EE2217FEA0C245,IMPHASH=0A3EDD26C3316ECFE90D2FD7F5A6288CtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071401Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.527{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\mlang.dll10.0.20348.1 (WinBuild.160101.0800)Multi Language Support DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMLANG.DLLMD5=F635814B71E913921DD8B5DFAD7A1BDB,SHA256=B2DE30EC133049FE1A19133F39666FD42F5485CCBCED132D2E81476324440356,IMPHASH=8C5EF934F2973563A30D41BD42A4CD00trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071400Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.512{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.20348.4163_none_37733df51661833c\comctl32.dll5.82 (WinBuild.160101.0800)Common Controls LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMCTL32.DLLMD5=13E16F4E06D73A8261100AFDCBB4A42D,SHA256=871A890A7E17068E4E7526ADD6AD26315E380C0D8039D470A7FD5679E388525B,IMPHASH=31C279E15AE041DC1102D6BC5ABF4EEDtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071399Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.510{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\Windows.StateRepositoryCore.dll10.0.20348.4647 (WinBuild.160101.0800)Windows StateRepository API CoreMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.StateRepositoryCore.dllMD5=C9952AC5A12B818667C83EC1860CA19F,SHA256=17C08095731859A5EF040ED45FB84740607F65D980D3673E6BADFC8C1DB51368,IMPHASH=A2423B4297D885EAC8873198BFFD930EtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071398Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.495{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\msvcp110_win.dll10.0.20348.1 (WinBuild.160101.0800)Microsoft® STL110 C++ Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp110_win.dllMD5=8ECDF52E1F44A64CACAF5F6614A6CB51,SHA256=07F8BE7A1ACFB43E58C575E68288C5A2D6E814B37881FD8563BE3FF3602DF491,IMPHASH=0C9842FA3B6083C81371783143E5B7E1trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071397Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.495{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\Windows.System.Launcher.dll10.0.20348.3692 (WinBuild.160101.0800)Windows.System.LauncherMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.System.Launcher.dllMD5=1CD331DB294B3AFAF4AF31E39C9E095B,SHA256=2690CA42C14639B6D251F65CFF6FD0055581EBF4B87056BB30275881F701669F,IMPHASH=D351F592997C5CDC60BD25A12D698D7BtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071396Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.495{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\cfgmgr32.dll10.0.20348.2849 (WinBuild.160101.0800)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=2DDEB31E18C325FA68D8CCDFA5A13989,SHA256=7142F200A0A26BFD18E91898A193F7C6621AF258C298AC30E55AF2EDE0AAFCB2,IMPHASH=E04847F9BDB09A939883C1CED2753C1FtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071395Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.480{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\propsys.dll7.0.20348.3451 (WinBuild.160101.0800)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=445ADFB5F4FDCD072E0288BB856207F3,SHA256=9C46B8403BBD306CD249D2D59D26FAA880D12B6B3C86ED07D9DBBB1F03524499,IMPHASH=5C01844375CBF9F186CA69B9C61D7F04trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071394Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.464{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\oleacc.dll7.2.20348.2849 (WinBuild.160101.0800)Active Accessibility Core ComponentMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEACC.DLLMD5=082F20C54EAE65DB82CB238A92BD9801,SHA256=9D0D9C4CBBDF853862824BF40F7E3B28ACAC323D5D345858A1464F6F7A6EAEF9,IMPHASH=6517312050B4616D31CD7BC770698E7DtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071393Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.464{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\TextShaping.dll-----MD5=80241EF1DB11D09B35EB3BAE1E624377,SHA256=DA873955ECA98B54EB56F41419881061F28C34F92D8F949408FB75051DFA9617,IMPHASH=A943777AC898B6DD3182E319E9ECBC5EtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071392Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.448{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\msctf.dll10.0.20348.3451 (WinBuild.160101.0800)MSCTF Server DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMSCTF.DLLMD5=881A14CE5EA6FD164F52CCFEA9A58D7D,SHA256=434A574CA2284E9C44D056C7C13043D3A71EE535372A476B1C594F2C90A4E09C,IMPHASH=0776D91314142E45B67DD169BBC3DB33trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071391Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.432{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\profapi.dll10.0.20348.2849 (WinBuild.160101.0800)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=DC8FC79DAC63F699DFF9C87D65EABB72,SHA256=F607C3584DFDE4311EF6C8AF69C597BB79A7B85297AD322F4C5CFD5F7FC3ACA0,IMPHASH=B8DD128776AE0DC1C388281DAE19746FtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071390Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.401{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\msxml6.dll6.30.20348.3451MSXML 6.0Microsoft XML Core ServicesMicrosoft CorporationMSXML6.dllMD5=5DE4A58734B018E85733421FCE95E64B,SHA256=0C9D0FCFB72EB4361AF57C423BAA8A9D4F5E287CE941B8D1B29B6E3AD0BE05A7,IMPHASH=B88656CB9F31BDE9013A61B5353C619DtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071389Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.385{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\mmcndmgr.dll10.0.20348.2849 (WinBuild.160101.0800)MMC Node Manager DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmmcndmgr.dllMD5=395D07BD947B990AB5BB0E3F8275F5F6,SHA256=95209D6FDA1FFBAAC5D0FDD5FA635C6BAFF53ACDDB2952EBED1CC3FEDE37ACD4,IMPHASH=E3D5B03D8BBDF3D1B7AA1D01E151C1DBtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071388Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.354{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\clbcatq.dll2001.12.10941.16384 (WinBuild.160101.0800)COM+ Configuration CatalogMicrosoft® Windows® Operating SystemMicrosoft CorporationCLBCATQ.DLLMD5=4C950A89A567FF6CF6C01FBF4CCB6EF6,SHA256=AD2416A9E767CD384668194CE2B64F60467BD17FC3AD400DB067DBEAB1C1E06E,IMPHASH=56BB3E75798DBD20E5737A82A31D85F9trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071387Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.354{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\netutils.dll10.0.20348.2849 (WinBuild.160101.0800)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=6DEE828A86F02C2C2AB625C93CA95400,SHA256=08AEA53537F5AF445531BCE2993E7FA9BAAF2A0229929282125AD9578B3C69AC,IMPHASH=641875F4AC691B0BCE7304317CB38D60trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071386Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.354{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\netutils.dll10.0.20348.2849 (WinBuild.160101.0800)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=6DEE828A86F02C2C2AB625C93CA95400,SHA256=08AEA53537F5AF445531BCE2993E7FA9BAAF2A0229929282125AD9578B3C69AC,IMPHASH=641875F4AC691B0BCE7304317CB38D60trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071385Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.354{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\srvcli.dll10.0.20348.3207 (WinBuild.160101.0800)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=9A360E8416991FA633809E7CED2F5997,SHA256=45F418DA037F66366F0061174A2C53FCDE1AFC6AF27304DE22FD5D766CBA5C5C,IMPHASH=394F449B593246CFD455CA13D43C340DtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071384Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.354{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\iertutil.dll11.00.20348.4297 (WinBuild.160101.0800)Run time utility for Internet ExplorerInternet ExplorerMicrosoft CorporationIeRtUtil.dllMD5=C005D8D6C639A9F02CE4A8688B081F98,SHA256=9AA02C4F29DD63632179C52852539DD845C53408064724E2AAAC4DD257FBCFB7,IMPHASH=FECAF6BE8F098F456CBD018A57AA7FD5trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071383Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.354{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\urlmon.dll11.00.20348.4294 (WinBuild.160101.0800)OLE32 Extensions for Win32Internet ExplorerMicrosoft CorporationUrlMon.dllMD5=8EFBEBE1D714BC688B143A60BB949123,SHA256=1E39B256150D6805F1AC35BA340AB3C00EF7EA283869BBD262FF434EC90C9229,IMPHASH=31D07198770C888C20AB68FE3354AC42trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071382Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.354{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\bcryptprimitives.dll10.0.20348.4648 (WinBuild.160101.0800)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=E64D3CD329E2DC90221D9EB5C63DA5BC,SHA256=6E9E896BC9AC68E007FFDD77FF4F74ED608AA161E5579BA3C9325EFFD871E365,IMPHASH=EAE5529FF99CF748E1E12282B7F070BDtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071381Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.354{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\kernel.appcore.dll10.0.20348.3692 (WinBuild.160101.0800)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=7384F75EB94C79BBA358ECD52107735D,SHA256=2DC22B4427BD7D73EBBE8F065C6BE888C2B4C8557BB4E28F557232058803C6BF,IMPHASH=EEF2D9DBE309708FA57F79AF196B14EBtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071380Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.338{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\windows.storage.dll10.0.20348.4647 (WinBuild.160101.0800)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=0E403DB2EBA30E18C01A8AD2FFA6E918,SHA256=F4FD4957B263DFBC44E80A565615CD5F947B5EAC41861014B05A98061B2AF60C,IMPHASH=22795E080295BEEAD00469F16D99B484trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071379Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.338{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.20348.4294_none_947bfbafeeecc1d8\comctl32.dll6.10 (WinBuild.160101.0800)User Experience Controls LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationcomctl32.DLLMD5=6763039F656109204FCAA888DE76C9F8,SHA256=8FFA7925D8BE0C3EADAF4EB5AF94C9F9B7AC67EAEE49A8445BC7568AC0FE62C1,IMPHASH=6B1AE6893AFE916D93CE039894CCADA0trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071378Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.338{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\dui70.dll10.0.20348.4294 (WinBuild.160101.0800)Windows DirectUI EngineMicrosoft® Windows® Operating SystemMicrosoft CorporationDUI70.DLLMD5=23B59F9B1249C52913865F63682EFFCB,SHA256=4B5F125D5EEC22B194B39E788D2E99226F9A7FB110949A967D0E2C7BF650E6FB,IMPHASH=C769F48D61AF7642F4368F0209257DCBtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071377Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.323{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\ninput.dll10.0.20348.3451 (WinBuild.160101.0800)Microsoft Pen and Touch Input ComponentMicrosoft® Windows® Operating SystemMicrosoft CorporationNINPUT.DLLMD5=4A5672975E09B71AE460E55FD2197CB0,SHA256=1C006929EBAEFC9799EC827E316354308AA6879CE2001AC9C838B6A8E374066D,IMPHASH=4CF29EF518B61A873658760F7D87B10FtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071376Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.306{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\SHCore.dll10.0.20348.3451 (WinBuild.160101.0800)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=A805371B54632E558392CC3118055E7A,SHA256=FCEB900EDCB1D2BF98959075FEB424E259F23051E5E51EEF0D5AF9B8D8E2990B,IMPHASH=7599EF4215A04467710EF12ED05095AFtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071375Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.306{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\UIAutomationCore.dll7.2.20348.3692 (WinBuild.160101.0800)Microsoft UI Automation CoreMicrosoft® Windows® Operating SystemMicrosoft CorporationUIAutomationCore.dllMD5=17EB3226F2CFD79AA268E43C00447361,SHA256=2B1EA113EBE23C8FDA36926F912891A85CAB28632CAFE5D255905BF66CB149C8,IMPHASH=BC203A5FC7B5DCD637014079A6020A79trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071374Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.274{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\oleaut32.dll10.0.20348.4294 (WinBuild.160101.0800)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=366EC68C517A40415BF943B890533637,SHA256=913FA63D3F87B0E330F0079236095C776B7FB250439679E5BBED7B4BFF17CFA3,IMPHASH=D33305947F500AE70A1EA67453AD203FtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071373Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.274{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\mfc42u.dll6.06.8063.0MFCDLL Shared Library - Retail VersionMicrosoft (R) Visual C++Microsoft CorporationMFC42.DLLMD5=457C2CB93BF64BA88CF318683A1AB3DB,SHA256=3533B322B0FB15563A5894040A210B10B4EAACC377E2CCA7050122B2B8A98765,IMPHASH=9CD149D9F734733906A6A8B12BB650B2trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071372Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.274{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\duser.dll10.0.20348.1 (WinBuild.160101.0800)Windows DirectUser EngineMicrosoft® Windows® Operating SystemMicrosoft CorporationDUser.DLLMD5=70598A4983B7FB7E4239F708AC12DF7A,SHA256=2880A55CAE7DB6F005493AAE03C2196E91515F68F1658687040A2A00A47F6E75,IMPHASH=DED4C21E45C796B0EB78DC53F6D15571trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071371Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.260{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\mmcbase.dll10.0.20348.4163 (WinBuild.160101.0800)MMC Base DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmmcbase.dllMD5=8F484D4891CD50A840D0B5DE8334DA7F,SHA256=86373BAAFDB14C65DE4FF0073D1A1C965908E3DDE2646887D8FF02C0182F6F78,IMPHASH=FFBA3E2F6C28398A8A660ADCF8083BBAtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071370Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.260{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\uxtheme.dll10.0.20348.3451 (WinBuild.160101.0800)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=B91ADE6B316806F0C6B263DD4F134852,SHA256=12A751808E450C90511BB22084328D744E376EDE399516CC7D65399770D7D05B,IMPHASH=46A3D751243935A50C83851DEF824D92trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071369Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\userenv.dll10.0.20348.3451 (WinBuild.160101.0800)UserenvMicrosoft® Windows® Operating SystemMicrosoft Corporationuserenv.dllMD5=E8668E2C0957DBB9F23A3EDD1D641F27,SHA256=E49E496B4170ECB87891DCF0B136DF8C509969F592BDC46FC7BD2E431CEAD96F,IMPHASH=1AD7006621C45489E91B7ED84F77402FtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071368Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\imm32.dll10.0.20348.3932 (WinBuild.160101.0800)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=A8834A1F608CD6B9A36E25B5E6A2CCBB,SHA256=32600C90650A6DDFE6F8CB6B81DB37E592ECF35410ECBC62BD1BD40C04C1ED96,IMPHASH=73579010BCAC70E264448DDA5ABE5C5EtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071367Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\sspicli.dll10.0.20348.4294 (WinBuild.160101.0800)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=AF430FB1C67CA27468D2FF54CEE3A82C,SHA256=A33DDF0600F8E097785399006450E006E7DDA37EB8ED8BAC00AE6DA3CAF9B48D,IMPHASH=BB93A383CDBB227A10969E4AB19AEA93trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071366Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\mpr.dll10.0.20348.2849 (WinBuild.160101.0800)Multiple Provider Router DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmpr.dllMD5=0584746876006A2BFF1118C9F1F3598B,SHA256=F00CF00F5DFE926B07C93ADF029CF63EE56846484054005FCA8BAF5F11AB6356,IMPHASH=20A055C902A467D5D15649CFA6502CEDtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071365Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\advapi32.dll10.0.20348.4163 (WinBuild.160101.0800)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=66B6F9D99FF66D7EEEE8C20EE9C488D4,SHA256=7790D317CE753B28527FD1E8B5DE0080BC74650B3C581DDAFA1E361E24101BDB,IMPHASH=4CBE4507656012CD74547FCE4958E4A0trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071364Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\shell32.dll10.0.20348.4647 (WinBuild.160101.0800)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=7DEE07C937BBF03C2FC3E081AEEF6097,SHA256=504C3E1133168E657E76B025DDB5FE71F11CDA4F091913B45CE85A9A1F350720,IMPHASH=8074CC5BAAB6B26C1F6828836C3C1C54trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071363Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\rpcrt4.dll10.0.20348.4648 (WinBuild.160101.0800)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=2AFE37D1000734D83E85803D5DCDF473,SHA256=94E56646B3A4EFB46EB6D730B2620F6F7A9DA7C04B041EA1FBF0EE6735259CAB,IMPHASH=327BB35E55C3470C69BF5CA13DFD6707trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071362Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\combase.dll10.0.20348.4647 (WinBuild.160101.0800)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=455E17FB878C885FF7023B01BEC5982E,SHA256=8F30663C1C2141D99FBDB52465F5DEEC0DB93CC9918C82C7925F286DCED6914E,IMPHASH=C208E3FC26D17A5406013A187A7F6099trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071361Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\ole32.dll10.0.20348.4405 (WinBuild.160101.0800)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=8F6E961EB7EC10AEB87DD31A171E5AFF,SHA256=10755B26981F1DE11042A668D7F9F63BBF26B1362BEF684C8F8D0D94B8BD58B2,IMPHASH=48427A1D5FB0B5EDB2A114EBE70BFC12trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071360Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\ucrtbase.dll10.0.20348.4648 (WinBuild.160101.0800)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=2E50483B32EBDEDA3D3337BB6F692816,SHA256=B7AAF94BE0BDF436C2DF1D836A6B67577A5719506CCDD3DBC26E86DC4145BC83,IMPHASH=577C6274AEFD71BB684CDFC802281DA3trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071359Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\msvcp_win.dll10.0.20348.4648 (WinBuild.160101.0800)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=B368D1D2C74F79DDD0E2CDAAF918E668,SHA256=743D96B51EAE62D40C5FC9F80C54F51DF5664798D64CE451D2F42D5286422D55,IMPHASH=DDF267D6F0C801CFD49649024F4EACF9trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071358Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\gdi32full.dll10.0.20348.4294 (WinBuild.160101.0800)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=97DBD959BACA8F9DA55CD8252FED2EE2,SHA256=EC9C70C1C8477D5CC2CCDAEB1DBACF33F52EA0FF60AE2E70772F3CE6A43F8D5D,IMPHASH=DB0E85D698495C071CDF9CF03DBBC108trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071357Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\gdi32.dll10.0.20348.3932 (WinBuild.160101.0800)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=BEDDBADA9F9D223F088FF380C5DB6781,SHA256=B8C516EFE02B723F4A79C38FABB5013AEA8BA2B6F8700EBE178A682EE359F11C,IMPHASH=2C46724ED9B41A7EE8022F80946DCF38trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071356Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\win32u.dll10.0.20348.4648 (WinBuild.160101.0800)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=0693EAADB69B53686E8CED39D1BC4F44,SHA256=0F434A9396F8A2E2338FF3C75E2D503F389A53F76DBD463BC097897750CFE08B,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071355Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\user32.dll10.0.20348.4294 (WinBuild.160101.0800)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=9D7AAB145A3FB1411D5771282E202042,SHA256=5A0D3FF6ECAA1DDD1DC3829F8E1EBE23B7773C904118266BD1AC05002FEE309B,IMPHASH=70FBF247DDE809E58F51CBAC57ABE6B1trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071354Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\shlwapi.dll10.0.20348.4294 (WinBuild.160101.0800)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=85BB094C8281746276758CBDFB376107,SHA256=C16C9A77F08B2AE3E69CF761A79B139845694E5554C6B84E8CA9F5B6D749C3A9,IMPHASH=1AD47207C8837E6F94AE4686710CD1B1trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071353Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\bcrypt.dll10.0.20348.4648 (WinBuild.160101.0800)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=D0AE6B5BA9E553502E295E258C90EBFF,SHA256=3F705F6911C2A9F09A84C3CE93F773A84DE5A00CA3CDBB1E37F0457C578ADBCD,IMPHASH=0050F83FC076977BD03F58FFD01ABD8FtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071352Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\sechost.dll10.0.20348.4648 (WinBuild.160101.0800)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=B81F2F7684A53250FB66759E9D37E49F,SHA256=58F3DDE3A1571061A931B86BCAA1991774EF49BC6AF401EBF1A0A843D64DF10F,IMPHASH=A73D9D8F49EA2EBD4AAD0B653AA04367trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071351Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\msvcrt.dll7.0.20348.4648 (WinBuild.160101.0800)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=3F92F245D403F2B3CF255B6D16B56052,SHA256=5899EE176260CE69FDB3344E6091306CE307D15DD01B50F269E64D6760FE5311,IMPHASH=AFF8CF12A2B8466DBCFC42EBF371249EtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071350Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.243{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\AcGenral.dll10.0.20348.2849 (WinBuild.160101.0800)Windows Compatibility DLLMicrosoft® Windows® Operating SystemMicrosoft Corporation"AcGenral.dll"MD5=BAA7239C4D8B488B39D52C2246C55789,SHA256=6107D9141134A6B378CC3ECFE2B7460FBFF355055D848DA2CD674DC86DA7DE26,IMPHASH=0D19F8F68A3849F893F8ED6AD90B63E7trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071349Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.229{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\apphelp.dll10.0.20348.3451 (WinBuild.160101.0800)Application Compatibility Client LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationApphelpMD5=CE568A217D2027C5E562F934EB5FE857,SHA256=5F7B0E5884C5CFF0AB6356F94DB8D0B9BFB25214448E21FD0C8FA4E38F6F480D,IMPHASH=0A6B84925E3371ABAA61162E59F4E09DtrueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071348Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.229{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\KernelBase.dll10.0.20348.4648 (WinBuild.160101.0800)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=CF8C487481CCD58DEE60028CE115B1E8,SHA256=C89BD4E30E338652E0E5922731BF59683F96B77C701B411F8E41D925C45847DD,IMPHASH=88E592D38ACA43570B46B985D0DC9187trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071347Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.229{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\kernel32.dll10.0.20348.4648 (WinBuild.160101.0800)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=E442C497314B344491E244A98CB7C50B,SHA256=D2E67A637703B776AB1A4FAC9AAF3548F2B07D5ECAF719C23999EF1E84A467FA,IMPHASH=968BE3A69AF1436ED6D3F369A721F850trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071346Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.229{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\ntdll.dll10.0.20348.4648 (WinBuild.160101.0800)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=B557496DA81E3D8789EC382143B9FC2C,SHA256=3D4B62B1AE21F5FC62D359B6520F36298A5E4E30A1F2DACAFFEE06AA3D507086,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator 734700x800000000000000071345Microsoft-Windows-Sysmon/OperationalEC2AMAZ-T09VU2I-2026-02-03 14:26:12.229{74a1e9e5-0584-6982-4fe0-000000005102}7236C:\Windows\System32\mmc.exeC:\Windows\System32\mmc.exe10.0.20348.4163 (WinBuild.160101.0800)Microsoft Management ConsoleMicrosoft® Windows® Operating SystemMicrosoft Corporationmmc.exeMD5=35215B244155E20A8D62E266BEBEF442,SHA256=ADAF93B3426C99DEEF5E4709AFAF1E27306140B887DA353D78F30280110A84CB,IMPHASH=8E50F3DB4704D326E38560580722C9B1trueMicrosoft WindowsValidEC2AMAZ-T09VU2I\Administrator